59.356 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.356 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più basso |
|---|---|---|---|---|
| CVE-2026-78462 | HIGH 8.8 | microsoft visual_studio_code Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 0,8% | — |
| CVE-2026-78461 | HIGH 7.4 | microsoft visual_studio_code Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 1,0% | — |
| CVE-2026-78457 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-78456 | HIGH 8.8 | microsoft sql_server_2022 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0,9% | — |
| CVE-2026-78455 | MED 4.3 | microsoft windows_10_1607 Out-of-bounds read in Xbox allows an unauthorized attacker to disclose information with a physical attack. | 0,5% | — |
| CVE-2026-78454 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally. | 0,4% | — |
| CVE-2026-78453 | MED 6.5 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network. | 0,9% | — |
| CVE-2026-78452 | MED 4.6 | microsoft windows_10_1809 Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information with a physical attack. | 0,5% | — |
| CVE-2026-78451 | MED 6.8 | microsoft windows_10_1809 Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack. | 0,4% | — |
| CVE-2026-78450 | HIGH 8.1 | microsoft windows_10_1809 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 0,7% | — |
| CVE-2026-78449 | HIGH 8.1 | microsoft windows_10_1607 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 0,7% | — |
| CVE-2026-78448 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-78447 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-78446 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. | 0,5% | — |
| CVE-2026-78445 | CRIT 9.8 | microsoft windows_server_2012 Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network. | 1,0% | — |
| CVE-2026-78444 | HIGH 8.1 | microsoft windows_10_1809 Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | 0,7% | — |
| CVE-2026-78442 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-78441 | MED 6.5 | microsoft sql_server_2017 Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network. | 0,9% | — |
| CVE-2026-78384 | HIGH 7.5 | apache cxf CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wr | — | — |
| CVE-2026-78329 | CRIT 9.8 | apache camel Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the | 0,7% | — |
| CVE-2026-78254 | HIGH 7.4 | apache ant The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker' | 0,5% | — |
| CVE-2026-78222 | HIGH 7.5 | A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: | 0,6% | — |
| CVE-2026-77911 | MED 6.5 | microsoft 365_apps Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 0,9% | — |
| CVE-2026-77909 | HIGH 7.7 | microsoft azure_cyclecloud Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network. | 0,6% | — |
| CVE-2026-77908 | HIGH 8.8 | microsoft dynamics_365 Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | 1,0% | — |