CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-53410	7	—	—	—	zoom / remote control for zoom contact center	A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Z	84d ago
CVE-2026-61389	7	—	—	—	—	An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory co	84d ago
CVE-2026-60063	7	—	—	—	—	An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory co	84d ago
CVE-2026-9046	7	—	—	—	—	A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applica	84d ago
CVE-2026-54684	7	—	—	—	—	jadx is a Dex to Java decompiler.	86d ago
CVE-2026-50526	7	—	—	—	microsoft / .net	Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform ta	86d ago
CVE-2026-58637	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges lo	86d ago
CVE-2026-58629	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-58619	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-58544	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-57093	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privilege	86d ago
CVE-2026-56187	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-56183	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-56173	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows WebView allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50674	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50672	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50669	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony S	86d ago
CVE-2026-50658	7	—	—	—	microsoft / defender for endpoint	Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate p	86d ago
CVE-2026-50503	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all	86d ago
CVE-2026-50491	7	—	—	—	microsoft / windows 10 1607	Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50490	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50459	7	—	—	—	microsoft / windows 10 21h2	Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.	86d ago
CVE-2026-50452	7	—	—	—	microsoft / windows 10 1809	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all	86d ago
CVE-2026-50449	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50410	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50406	7	—	—	—	microsoft / windows 10 21h2	Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50404	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allow	86d ago
CVE-2026-50403	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all	86d ago
CVE-2026-50397	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50396	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50393	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50392	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50390	7	—	—	—	microsoft / windows 10 1607	Access of resource using incompatible type ('type confusion') in Windows Kernel allows an authorized attacker to e	86d ago
CVE-2026-50372	7	—	—	—	microsoft / windows 10 1607	Buffer over-read in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally	86d ago
CVE-2026-50371	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows LUAFV allow	86d ago
CVE-2026-50359	7	—	—	—	microsoft / windows 10 1607	Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50358	7	—	—	—	microsoft / windows 10 1607	Use after free in Windows Media allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50348	7	—	—	—	microsoft / windows 10 1809	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all	86d ago
CVE-2026-50345	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all	86d ago
CVE-2026-50322	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all	86d ago
CVE-2026-50307	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-58526	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-54996	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print D	86d ago
CVE-2026-54989	7	—	—	—	microsoft / windows 10 1607	Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate	86d ago
CVE-2026-54129	7	—	—	—	microsoft / windows 10 1809	Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-54111	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print D	86d ago
CVE-2026-50384	7	—	—	—	microsoft / windows 10 1809	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clip Servic	86d ago
CVE-2026-50356	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows A	86d ago
CVE-2026-50325	7	—	—	—	microsoft / windows 10 1607	Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50323	7	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50297	7	—	—	—	microsoft / windows 10 1607	Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-50296	7	—	—	—	microsoft / windows 10 1607	Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-49806	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print D	86d ago
CVE-2026-49805	7	—	—	—	microsoft / windows 10 1607	Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-49803	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deploy	86d ago
CVE-2026-49802	7	—	—	—	microsoft / windows 11 24h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print D	86d ago
CVE-2026-49784	7	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows A	86d ago
CVE-2026-49183	7	—	—	—	microsoft / windows 10 1809	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard S	86d ago
CVE-2026-49162	7	—	—	—	microsoft / windows 11 24h2	Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.	86d ago
CVE-2026-48572	7	—	—	—	microsoft / windows 11 23h2	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Install	86d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker