Vulnerabilities exploitable today
412,870in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,779
New KEV · 24H0
Exploit Today ≥ 701,703
Distribution · last window
- Critical5,666
- High22,249
- Medium20,641
- Low2,127
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1127637.0 HIG—
——0Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.10hCVE-2026-1127628.8 HIG—
——0Relative path traversal in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.10hCVE-2017-4481——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none24dCVE-2026-1127617.0 HIG—
——0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.10hCVE-2026-1127607.8 HIG—
——0Integer overflow or wraparound in Windows Overlay Filter allows an unauthorized attacker to elevate privileges locally.10hCVE-2026-1127597.0 HIG—
——0Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.10hCVE-2026-1127587.8 HIG—
——0Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.10hCVE-2026-1127576.0 MED—
——0Exposure of sensitive information to an unauthorized actor in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.10hCVE-2018-4724——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2026-1127418.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-2647——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26dCVE-2026-1127398.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1127386.5 MED—
——0Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.10hCVE-2026-1127378.8 HIG—
——0Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.10hCVE-2026-1127365.3 MED—
——0Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.10hCVE-2026-1127228.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1127218.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1127205.5 MED—
——0Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.10hCVE-2026-825186.5 MED—
——0Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside the install directory via unvalidated commands[].name values in cli.json. Attackers who convince victims to install or update a package can use '..' segments to overwrite executables on the user's PATH, persisting after uninstall.14hCVE-2019-18717——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none24dCVE-2026-1253237.8 HIG—
——0pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0.13hCVE-2026-1253255.9 MED—
——0pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.13hCVE-2018-4809——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2026-1253424.7 MED—
——0Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)11hCVE-2026-1253438.3 HIG—
——0Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)10hCVE-2018-4808——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2026-1253448.8 HIG—
——0Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)10hCVE-2026-1253454.7 MED—
——0Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)10hCVE-2023-38539——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused76dCVE-2017-4075——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none24dCVE-2026-25093——
——0Rejected reason: Not used24dCVE-2026-22832——
——0Rejected reason: Not used24dCVE-2026-40064——
——0Improper input validation for some Intel(R) oneAPI CLI Tool software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.9hCVE-2026-40216——
——0Out-of-bounds read for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.9hCVE-2026-40697——
——0Use after free for some Intel(R) Wireless Software for Windows within Ring 3: User Applications may allow denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (low) and availability (low) impacts.9hCVE-2017-4621——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none24dCVE-2026-1127188.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1127178.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1127168.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1127158.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10h