Vulnerabilities exploitable today
412,870in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,779
New KEV · 24H0
Exploit Today ≥ 701,703
Distribution · last window
- Critical5,666
- High22,249
- Medium20,641
- Low2,127
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1100527.5 HIG—
——0Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2019-18544——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none24dCVE-2018-16906——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none24dCVE-2013-5294——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2026-1100478.8 HIG—
——0Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1100438.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.10hCVE-2026-1095058.8 HIG—
——0Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2016-9770——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none24dCVE-2025-47296——
——0Rejected reason: Not used24dCVE-2026-60139——
——0Improper neutralization in the MigTD SPDM transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.9hCVE-2026-1095047.3 HIG—
——0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.10hCVE-2026-1095038.8 HIG—
——0Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10hCVE-2026-1094998.8 HIG—
——0Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.10hCVE-2026-1094987.5 HIG—
——0Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.10hCVE-2024-8333——
——0Rejected reason: Test CVE1dCVE-2026-1094977.3 HIG—
——0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.10hCVE-2026-1094968.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.10hCVE-2026-1094956.6 MED—
——0Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.10hCVE-2026-1094948.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.10hCVE-2010-3799——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2024-42992——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.1dCVE-2026-1094938.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.10hCVE-2018-4746——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2026-1094928.8 HIG—
——0Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.10hCVE-2026-1094757.5 HIG—
——0Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.7hCVE-2026-1094737.8 HIG—
——0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.9hCVE-2026-1094728.8 HIG—
——0Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.9hCVE-2026-1094679.9 CRI—
——0Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.9hCVE-2026-1094668.0 HIG—
——0Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.9hCVE-2024-42675——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.1dCVE-2024-7633——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.1dCVE-2026-1094648.8 HIG—
——0Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.9hCVE-2026-1094638.8 HIG—
——0Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.9hCVE-2026-1094556.5 MED—
——0Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.10hCVE-2026-1084696.8 MED—
——0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.10hCVE-2026-1084255.9 MED—
——0Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.10hCVE-2026-1084246.5 MED—
——0Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.10hCVE-2026-1084234.7 MED—
——0Out-of-bounds read in Windows WinHTTP allows an authorized attacker to disclose information locally.10hCVE-2026-1084217.5 HIG—
——0Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network.10hCVE-2026-1084186.5 MED—
——0Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.10h