CVE Watch412,870 in full archive

Vulnerabilities exploitable today

412,870in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,779

New KEV · 24H0

Exploit Today ≥ 701,703

Distribution · last window

Critical
5,666
High
22,249
Medium
20,641
Low
2,127

Filters

Window

Severity

Flags

Vulnerabilities412,241–412,280 · 412,870

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1054998.8 HIG

—

——0Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.8h CVE-2026-1055017.8 HIG

—

——0Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.8h CVE-2026-1055037.8 HIG

—

——0Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.8h CVE-2026-1055047.0 HIG

—

——0An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application. The security update addresses the vulnerability by ensuring the Windows Kernel properly handles objects in memory.8h CVE-2026-1055188.8 HIG

—

——0Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.9h CVE-2026-1055275.5 MED

—

——0Untrusted pointer dereference in Windows Encrypting File System (EFS) allows an authorized attacker to deny service locally.9h CVE-2025-58164—

—

——0Rejected reason: This CVE is a duplicate of another CVE, CVE-2025-58163.1d CVE-2025-58165—

—

——0Rejected reason: This CVE is a duplicate of another CVE, CVE-2025-58163.1d CVE-2025-58170—

—

——0Rejected reason: This CVE is a duplicate of another CVE.1d CVE-2025-12068—

—

——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.3d CVE-2025-65794—

—

——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.1d CVE-2025-66478—

—

——0Rejected reason: This CVE is a duplicate of CVE-2025-55182.1d CVE-2025-34604—

—

——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.1d CVE-2026-123424—

—

——0Rejected reason: This CVE ID has been rejected as a duplicate.1d CVE-2026-57893—

—

——0Incomplete internal state distinction in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.9h CVE-2026-1054257.2 HIG

—

——0OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.12h CVE-2026-1054266.7 MED

—

——0Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.12h CVE-2025-34788—

—

——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.22d CVE-2018-4497—

—

——0Rejected reason: This candidate is unused by its CNA.24d CVE-2026-1054274.9 MED

—

——0Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.12h CVE-2026-1056696.7 MED

—

——0Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.12h CVE-2026-1058136.3 MED

—

——0Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.14h CVE-2026-1074044.9 MED

—

——0Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.12h CVE-2025-54666—

—

——0Rejected reason: Not used24d CVE-2026-1081869.6 CRI

—

——0Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.14h CVE-2026-1216638.8 HIG

—

——0Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.11h CVE-2026-1216628.6 HIG

—

——0Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.9h CVE-2026-1216617.8 HIG

—

——0Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.11h CVE-2026-1216607.5 HIG

—

——0Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.4h CVE-2026-1207965.3 MED

—

——0Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.4h CVE-2026-1207927.3 HIG

—

——0Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.4h CVE-2026-1207888.8 HIG

—

——0Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.9h CVE-2026-1207868.8 HIG

—

——0Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.9h CVE-2026-1207858.8 HIG

—

——0Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.9h CVE-2026-1207836.4 MED

—

——0Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.4h CVE-2026-1207827.8 HIG

—

——0Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.4h CVE-2026-1207799.6 CRI

—

——0Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.11h CVE-2026-1207787.3 HIG

—

——0Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.11h CVE-2026-1200067.5 HIG

—

——0Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.6h CVE-2026-1199915.9 MED

—

——0Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.11h