CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-45458	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	125d ago
CVE-2026-45456	8.4	—	—	—	microsoft / 365 apps	Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker	125d ago
CVE-2026-44810	8.4	—	—	—	microsoft / windows 11 23h2	Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges lo	125d ago
CVE-2026-41098	8.4	—	—	—	microsoft / azure stack edge	Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an	125d ago
CVE-2026-46326	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix spi_transfer s	125d ago
CVE-2026-46288	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in of_unittes	126d ago
CVE-2026-26422	8.4	—	—	—	—	clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.	127d ago
CVE-2019-25736	8.4	—	—	—	—	LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitr	130d ago
CVE-2019-25735	8.4	—	—	—	—	AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers to overwrite st	130d ago
CVE-2019-25733	8.4	—	—	—	—	NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local at	130d ago
CVE-2026-46270	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in p	131d ago
CVE-2026-46251	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corrupt	131d ago
CVE-2019-25718	8.4	—	—	—	draeger / infinity explorer c700 firmware	Dräger Infinity Explorer C700 contains a privilege escalation vulnerability that allows attackers to break out of	132d ago
CVE-2025-48595zero day	8.4	1.7%	3/3	same day	google / android	In multiple locations, there is a possible way to achieve code execution due to an integer overflow.	132d ago
CVE-2018-25432	8.4	—	—	—	—	Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by o	132d ago
CVE-2026-6824	8.4	—	—	—	—	A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient san	136d ago
CVE-2018-25383	8.4	—	—	—	—	Free MP3 CD Ripper 2.8 contains a stack-based buffer overflow vulnerability in WMA file processing that allows loc	136d ago
CVE-2026-49238	8.4	—	—	—	canonical / multipass	An issue was discovered in Canonical Multipass before version 1.16.3.	137d ago
CVE-2026-45108	8.4	—	—	—	—	Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.	137d ago
CVE-2026-7365	8.4	—	—	—	ibm / operations analytics log analysis	IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default	138d ago
CVE-2026-40851	8.4	—	—	—	—	A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick lead	138d ago
CVE-2018-25377	8.4	—	—	—	—	Flash Slideshow Maker Professional 5.20 contains a buffer overflow vulnerability in the registration dialog that a	140d ago
CVE-2018-25376	8.4	—	—	—	—	Socusoft 3GP Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows	140d ago
CVE-2018-25375	8.4	—	—	—	—	SocuSoft iPod Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows	140d ago
CVE-2018-25373	8.4	—	—	—	—	SocuSoft DVD Photo Slideshow Professional 8.07 contains a stack-based buffer overflow vulnerability in the registr	140d ago
CVE-2018-25366	8.4	—	—	—	—	CuteFTP 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by i	140d ago
CVE-2018-25360	8.4	—	—	—	—	AgataSoft Auto PingMaster 1.5 contains a stack-based buffer overflow vulnerability in the Trace Route host name fi	140d ago
CVE-2018-25359	8.4	—	—	—	—	Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privile	140d ago
CVE-2018-25356	8.4	—	—	—	—	SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows	142d ago
CVE-2018-25355	8.4	—	—	—	—	Audiograbber 1.83 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code b	142d ago
CVE-2018-25345	8.4	—	—	—	—	10-Strike Network Scanner 3.0 contains a local buffer overflow vulnerability in the host name field that allows at	142d ago
CVE-2018-25344	8.4	—	—	—	—	10-Strike Network Inventory Explorer 8.54 contains a stack-based buffer overflow vulnerability in the registration	142d ago
CVE-2026-2740	8.4	—	—	—	—	Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plu	144d ago
CVE-2026-45253	8.4	—	—	—	freebsd / freebsd	ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls.	144d ago
CVE-2026-9157	8.4	—	—	—	—	Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows	144d ago
CVE-2026-5804	8.4	—	—	—	—	An improper authentication vulnerability was discovered in the Motorola Factory Test component (com.motorola.motoci	146d ago
CVE-2026-25781	8.4	—	—	—	—	in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.	146d ago
CVE-2018-25328	8.4	—	—	—	—	VX Search 10.6.18 contains a local buffer overflow vulnerability that allows attackers to overwrite the instructio	148d ago
CVE-2018-25323	8.4	—	—	—	—	Allok AVI DivX MPEG to DVD Converter 2.6.1217 contains a structured exception handler buffer overflow vulnerabilit	148d ago
CVE-2018-25322	8.4	—	—	—	—	Allok Fast AVI MPEG Splitter 1.2 contains a stack based buffer overflow vulnerability that allows local attackers	148d ago
CVE-2026-41964	8.4	—	—	—	—	Permission control vulnerability in the web.	150d ago
CVE-2020-37221	8.4	—	—	—	—	Atomic Alarm Clock 6.3 contains a stack overflow vulnerability that allows local attackers to execute arbitrary co	152d ago
CVE-2026-25705	8.4	—	—	—	—	A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations	152d ago
CVE-2026-40367	8.4	—	—	—	microsoft / 365 apps	Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized atta	153d ago
CVE-2026-40366	8.4	—	—	—	microsoft / 365 apps	Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized atta	153d ago
CVE-2026-40364	8.4	—	—	—	microsoft / 365 apps	Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized atta	153d ago
CVE-2026-40363	8.4	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	153d ago
CVE-2026-40361	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	153d ago
CVE-2026-40358	8.4	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	153d ago
CVE-2026-43991	8.4	—	—	—	—	JunoClaw is an agentic AI platform built on Juno Network.	153d ago
CVE-2026-43990	8.4	—	—	—	—	JunoClaw is an agentic AI platform built on Juno Network.	153d ago
CVE-2026-34963	8.4	—	—	—	pengutronix / barebox	barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loa	153d ago
CVE-2026-4892	8.4	—	—	—	—	A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to ex	154d ago
CVE-2019-25637	8.4	—	—	—	—	X-NetStat Pro 5.63 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary	202d ago
CVE-2019-25634	8.4	—	—	—	4mhz / base64 decoder	Base64 Decoder 1.1.2 contains a stack-based buffer overflow vulnerability that allows local attackers to execute a	202d ago
CVE-2019-25633	8.4	—	—	—	aida64 / aida64	AIDA64 Extreme 5.99.4900 contains a structured exception handling buffer overflow vulnerability that allows local	202d ago
CVE-2019-25631	8.4	—	—	—	aida64 / aida64	AIDA64 Business 5.99.4900 contains a structured exception handling buffer overflow vulnerability that allows local	202d ago
CVE-2019-25629	8.4	—	—	—	aida64 / aida64	AIDA64 Extreme 5.99.4900 contains a structured exception handler buffer overflow vulnerability in the logging func	202d ago
CVE-2019-25627	8.4	—	—	—	flexhex / flexhex	FlexHEX 2.71 contains a local buffer overflow vulnerability in the Stream Name field that allows local attackers t	202d ago
CVE-2019-25626	8.4	—	—	—	river past cam do project / river past cam do	River Past Cam Do 3.7.6 contains a local buffer overflow vulnerability in the activation code input field that all	202d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker