CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

1,109 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-45640	7	—	—	—	microsoft / windows 10 21h2	Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.	135d ago
CVE-2026-45603	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary F	135d ago
CVE-2026-45601	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary F	135d ago
CVE-2026-45598	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary F	135d ago
CVE-2026-45597	7	—	—	—	microsoft / windows 11 23h2	Concurrent execution using shared resource with improper synchronization ('race condition') in UI Automation Manag	135d ago
CVE-2026-45596	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privilege	135d ago
CVE-2026-44818	7	—	—	—	microsoft / 365 apps	Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Ex	135d ago
CVE-2026-42984	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.	135d ago
CVE-2026-42912	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony S	135d ago
CVE-2026-42911	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privilege	135d ago
CVE-2026-42836	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery	135d ago
CVE-2026-41108	7	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.	135d ago
CVE-2026-34335	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privilege	135d ago
CVE-2026-42825	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.	163d ago
CVE-2026-40410	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.	163d ago
CVE-2026-35416	7	—	—	—	microsoft / windows 10 1607	Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock all	163d ago
CVE-2026-34347	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.	163d ago
CVE-2026-34345	7	—	—	—	microsoft / windows 10 1607	Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock all	163d ago
CVE-2026-34342	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spool	163d ago
CVE-2026-34341	7	—	—	—	microsoft / windows 10 1607	Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges lo	163d ago
CVE-2026-34340	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.	163d ago
CVE-2026-34331	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GR	163d ago
CVE-2026-33839	7	—	—	—	microsoft / windows 10 1809	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GR	163d ago
CVE-2026-26136	6.5	—	—	—	microsoft / copilot	Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an	217d ago
CVE-2026-26120	6.5	—	—	—	microsoft / bing	Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a n	217d ago
CVE-2026-56164zero day	5.3	1.0%	3/3	same day	microsoft / sharepoint server	Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to ele	100d ago
CVE-2026-24299	5.3	—	—	—	microsoft / 365 copilot	Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unau	217d ago
CVE-2026-0385	5	—	—	—	microsoft / edge chromium	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	220d ago
CVE-2026-45498zero day	4	1.3%	3/3	1d before	microsoft / defender antimalware platform	Microsoft Defender Denial of Service Vulnerability	155d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker