CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-68792	7.8	—	—	—	microsoft / 365 apps	Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an	64d ago
CVE-2026-66807	7.8	—	—	—	microsoft / 365 apps	Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-66804	7.8	—	—	—	microsoft / windows 10 22h2	Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locall	64d ago
CVE-2026-66799	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-65814	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges loca	64d ago
CVE-2026-65810	7.8	—	—	—	microsoft / .net framework	Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.	64d ago
CVE-2026-65790	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-65787	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-65786	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-65775	7.8	—	—	—	microsoft / windows 10 1607	Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-65774	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-65773	7.8	—	—	—	microsoft / windows 10 1809	Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-65673	7.8	—	—	—	microsoft / entra connect	Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sy	64d ago
CVE-2026-65672	7.8	—	—	—	microsoft / windows 11 23h2	Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locall	64d ago
CVE-2026-65671	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locall	64d ago
CVE-2026-65664	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-65661	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-65657	7.8	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-65656	7.8	—	—	—	microsoft / 365 apps	Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an	64d ago
CVE-2026-64920	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64919	7.8	—	—	—	microsoft / 365 apps	Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64915	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64914	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64912	7.8	—	—	—	microsoft / 365 apps	Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64911	7.8	—	—	—	microsoft / 365 apps	Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64910	7.8	—	—	—	microsoft / 365 apps	Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64909	7.8	—	—	—	microsoft / 365 apps	Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally	64d ago
CVE-2026-64908	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64907	7.8	—	—	—	microsoft / 365 apps	Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64906	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64905	7.8	—	—	—	microsoft / 365 apps	Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64904	7.8	—	—	—	microsoft / 365 apps	Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker	64d ago
CVE-2026-64903	7.8	—	—	—	microsoft / 365 apps	Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-64898	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63533	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63532	7.8	—	—	—	microsoft / 365 apps	Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63527	7.8	—	—	—	microsoft / 365 apps	Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63526	7.8	—	—	—	microsoft / 365 apps	Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63525	7.8	—	—	—	microsoft / 365 apps	Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63522	7.8	—	—	—	microsoft / azure sql database	Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to eleva	64d ago
CVE-2026-63519	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63518	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63515	7.8	—	—	—	microsoft / 365 apps	Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-63513	7.8	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-62909	7.8	—	—	—	microsoft / visual studio 2022	Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-62894	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally	64d ago
CVE-2026-62890	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows GDI+ allows an authorized attacker to execute code locally.	64d ago
CVE-2026-62888	7.8	—	—	—	microsoft / windows 10 21h2	Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-62886	7.8	—	—	—	microsoft / visual studio 2022	Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.	64d ago
CVE-2026-62885	7.8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-62880	7.8	—	—	—	microsoft / windows 10 1607	Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-62877	7.8	—	—	—	microsoft / windows 10 1607	Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-62876	7.8	—	—	—	microsoft / windows 10 1607	Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-62871	7.8	—	—	—	microsoft / .net	Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.	64d ago
CVE-2026-62832	7.8	—	—	—	microsoft / windows 10 21h2	Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorize	64d ago
CVE-2026-62812	7.8	—	—	—	microsoft / windows 10 1607	Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacke	64d ago
CVE-2026-62811	7.8	—	—	—	microsoft / windows 11 23h2	Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.	64d ago
CVE-2026-62807	7.8	—	—	—	microsoft / windows 10 1607	Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacke	64d ago
CVE-2026-62803	7.8	—	—	—	microsoft / windows 10 1607	Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacke	64d ago
CVE-2026-62799	7.8	—	—	—	microsoft / windows 11 26h1	Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.	64d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker