CVE Watch412,870 in full archive

Vulnerabilities exploitable today

412,870in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,779

New KEV · 24H0

Exploit Today ≥ 701,703

Distribution · last window

Critical
5,666
High
22,249
Medium
20,641
Low
2,127

Filters

Window

Severity

Flags

Vulnerabilities412,361–412,400 · 412,870

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1198818.8 HIG

—

——0Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to elevate privileges over a network.10h CVE-2026-1198807.5 HIG

—

——0Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.10h CVE-2026-1198767.0 HIG

—

——0Heap-based buffer overflow in Windows USB Scanner Driver allows an authorized attacker to elevate privileges locally.10h CVE-2026-1198754.0 MED

—

——0Numeric truncation error in Windows Storport Miniport Driver allows an authorized attacker to disclose information with a physical attack.10h CVE-2026-1198575.5 MED

—

——0Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally.10h CVE-2026-1198398.8 HIG

—

——0Untrusted search path in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network.10h CVE-2026-1198384.7 MED

—

——0Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally.10h CVE-2026-1198377.5 HIG

—

——0Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.10h CVE-2026-1198364.7 MED

—

——0Use after free in Windows Management Services allows an authorized attacker to disclose information locally.10h CVE-2026-1198357.0 HIG

—

——0Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.10h CVE-2026-1198347.8 HIG

—

——0Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.10h CVE-2026-1198187.8 HIG

—

——0Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.10h CVE-2026-1198177.8 HIG

—

——0Double free in Windows Shell allows an authorized attacker to elevate privileges locally.10h CVE-2026-1198167.8 HIG

—

——0Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.10h CVE-2026-1194057.0 HIG

—

——0Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.10h CVE-2026-1193937.8 HIG

—

——0Stack-based buffer overflow in Windows Credential Manager allows an authorized attacker to elevate privileges locally.10h CVE-2026-1193928.8 HIG

—

——0Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to elevate privileges over a network.10h CVE-2026-1193917.8 HIG

—

——0Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.10h CVE-2026-1193907.8 HIG

—

——0Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code locally.10h CVE-2026-1193897.0 HIG

—

——0Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.10h CVE-2026-1240382.3 LOW

—

——0An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.13h CVE-2026-1257475.4 MED

—

——0ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects.14h CVE-2026-1257494.2 MED

—

——0TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts.13h CVE-2026-1257507.1 HIG

—

——0Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.14h CVE-2026-1257535.9 MED

—

——0ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.13h CVE-2026-1257547.1 HIG

—

——0Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.14h CVE-2026-1257556.5 MED

—

——0Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.14h CVE-2026-117841—

—

——0Rejected reason: Reserved in error; never associated with a vulnerability.14d CVE-2026-1257565.9 MED

—

——0postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.11h CVE-2026-1257579.1 CRI

—

——0mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.13h CVE-2026-1193887.0 HIG

—

——0Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.10h CVE-2026-181286.8 MED

—

——0Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.14h CVE-2026-86336—

—

——0Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14h CVE-2026-1193877.0 HIG

—

——0Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.10h CVE-2026-1193867.0 HIG

—

——0Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.10h CVE-2026-1193854.7 MED

—

——0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to deny service locally.10h CVE-2026-1193836.6 MED

—

——0Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.10h CVE-2026-1193827.8 HIG

—

——0Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.10h CVE-2026-1187477.5 HIG

—

——0Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.6h CVE-2026-1187466.8 MED

—

——0Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.10h