CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-42912	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony S	134d ago
CVE-2026-42911	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privilege	134d ago
CVE-2026-42836	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery	134d ago
CVE-2026-41108	7	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.	134d ago
CVE-2026-34335	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privilege	134d ago
CVE-2026-46309	7	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU	135d ago
CVE-2026-46299	7	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_s	135d ago
CVE-2026-46164	7	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_su	146d ago
CVE-2026-46154	7	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: sched_ext: Read scx_root under scx_cgroup_ops_	146d ago
CVE-2026-44604	7	—	—	—	—	A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM.	146d ago
CVE-2026-46029	7	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: mm/slab: return NULL early from kmalloc_nolock	147d ago
CVE-2026-49000	7	—	—	—	—	An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, in	147d ago
CVE-2025-46284	7	—	—	—	apple / macos	A race condition was addressed with additional validation.	148d ago
CVE-2026-24200	7	—	—	—	—	NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause a use-afte	148d ago
CVE-2025-71215	7	—	—	—	trendmicro / apex one	A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verifica	153d ago
CVE-2026-29518	7	—	—	—	samba / rsync	Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling	154d ago
CVE-2026-45036	7	—	—	—	tabby / tabby	Tabby (formerly Terminus) is a highly configurable terminal emulator.	159d ago
CVE-2025-54518	7	—	—	—	—	Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attac	159d ago
CVE-2026-42825	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.	162d ago
CVE-2026-40410	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.	162d ago
CVE-2026-35416	7	—	—	—	microsoft / windows 10 1607	Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock all	162d ago
CVE-2026-34347	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.	162d ago
CVE-2026-34345	7	—	—	—	microsoft / windows 10 1607	Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock all	162d ago
CVE-2026-34342	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spool	162d ago
CVE-2026-34341	7	—	—	—	microsoft / windows 10 1607	Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges lo	162d ago
CVE-2026-34340	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.	162d ago
CVE-2026-34331	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GR	162d ago
CVE-2026-33839	7	—	—	—	microsoft / windows 10 1809	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GR	162d ago
CVE-2026-7818	7	—	—	—	pgadmin / pgadmin 4	Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.	163d ago
CVE-2026-4546	7	—	—	—	flos-freeware / notepad2	A weakness has been identified in Flos Freeware Notepad2 4.2.25.	213d ago
CVE-2026-4545	7	—	—	—	flos-freeware / notepad2	A security flaw has been discovered in Flos Freeware Notepad2 4.2.25.	213d ago
CVE-2026-32611	7	—	—	—	nicolargo / glances	Glances is an open-source system cross-platform monitoring tool.	217d ago
CVE-2026-32608	7	—	—	—	nicolargo / glances	Glances is an open-source system cross-platform monitoring tool.	217d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker