Vulnerabilities exploitable today
412,870in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,779
New KEV · 24H0
Exploit Today ≥ 701,703
Distribution · last window
- Critical5,666
- High22,249
- Medium20,641
- Low2,127
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1199909.8 CRI—
——0Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.10hCVE-2026-1199887.1 HIG—
——0Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.11hCVE-2026-1199877.8 HIG—
——0Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.11hCVE-2026-1199714.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.11hCVE-2026-1199704.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.11hCVE-2026-1199698.8 HIG—
——0Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.11hCVE-2025-34787——
——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.22dCVE-2017-1872——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none24dCVE-2026-1199678.1 HIG—
——0Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.11hCVE-2026-1199667.5 HIG—
——0Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.11hCVE-2026-1199595.3 MED—
——0Improper access control in Windows Hyper-V allows an authorized attacker to perform spoofing locally.11hCVE-2026-1199589.8 CRI—
——0Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.10hCVE-2026-1199577.8 HIG—
——0Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.11hCVE-2026-1199556.0 MED—
——0Uncontrolled resource consumption in Windows Hyper-V allows an authorized attacker to deny service locally.11hCVE-2026-1199547.8 HIG—
——0Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.11hCVE-2026-1199537.8 HIG—
——0Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.11hCVE-2026-1199528.1 HIG—
——0Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.11hCVE-2026-1199508.8 HIG—
——0Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.11hCVE-2026-1199487.5 HIG—
——0Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.11hCVE-2026-1199477.5 HIG—
——0Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.11hCVE-2026-1199465.9 MED—
——0Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network.11hCVE-2026-1199458.1 HIG—
——0Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.11hCVE-2026-1199447.5 HIG—
——0Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network.11hCVE-2026-1199437.8 HIG—
——0Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.11hCVE-2026-1199424.7 MED—
——0Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.11hCVE-2026-1199417.8 HIG—
——0Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally.11hCVE-2026-111239——
——0The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users.14hCVE-2026-111240——
——0The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111241——
——0When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111242——
——0When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111244——
——0When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111245——
——0After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111246——
——0The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.14hCVE-2026-111247——
——0When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111248——
——0The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111249——
——0The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111250——
——0The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.14hCVE-2026-111251——
——0The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14hCVE-2026-111256——
——0When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.14hCVE-2026-111257——
——0With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14h