Vulnerabilities exploitable today
412,870in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,779
New KEV · 24H0
Exploit Today ≥ 701,703
Distribution · last window
- Critical5,666
- High22,249
- Medium20,641
- Low2,127
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-32667——
——0Out-of-bounds write for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2026-32670——
——0Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2026-33270——
——0Improper input validation for some Intel(R) Graphics Software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2026-1137735.3 MED—
——0Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network.9hCVE-2026-1137724.7 MED—
——0Time-of-check time-of-use (toctou) race condition in Windows Redirected Drive Buffering allows an authorized attacker to disclose information locally.9hCVE-2026-1137715.5 MED—
——0Off-by-one error in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.9hCVE-2026-1137707.0 HIG—
——0Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.9hCVE-2026-33279——
——0Out-of-bounds write for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2026-21645——
——0Rejected reason: Not used24dCVE-2026-21646——
——0Rejected reason: Not used24dCVE-2022-38322——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.24dCVE-2026-1137677.8 HIG—
——0Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.9hCVE-2017-1969——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none24dCVE-2026-1137663.3 LOW—
——0Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.9hCVE-2026-1137657.8 HIG—
——0Heap-based buffer overflow in Windows File Server Resource Management Service allows an authorized attacker to elevate privileges locally.9hCVE-2026-1137644.7 MED—
——0Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to disclose information locally.9hCVE-2026-1137636.3 MED—
——0Use of a broken or risky cryptographic algorithm in Windows DPAPI (Data Protection Application Programming Interface) allows an authorized attacker to elevate privileges locally.9hCVE-2026-1137627.0 HIG—
——0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.9hCVE-2026-1137617.0 HIG—
——0Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.9hCVE-2017-4107——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none24dCVE-2026-1137608.8 HIG—
——0Heap-based buffer overflow in Windows XWizard Framework allows an authorized attacker to elevate privileges locally.9hCVE-2026-33563——
——0Exposure of sensitive information to an unauthorized actor for some Intel(R) Platform Monitoring Technology (Intel(R) PMT) software before version 3.2.0.22 within Ring 3: User Applications may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2026-33571——
——0Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2026-34016——
——0Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2016-2766——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none24dCVE-2024-41024——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26dCVE-2026-1137597.8 HIG—
——0Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.9hCVE-2026-1137587.8 HIG—
——0Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.9hCVE-2026-1137575.5 MED—
——0Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.9hCVE-2026-1137565.3 MED—
——0Improper access control in Windows FileCrypt Driver allows an authorized attacker to bypass a security feature over a network.9hCVE-2019-25685——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.24dCVE-2026-1137544.7 MED—
——0Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.9hCVE-2026-1137538.2 HIG—
——0Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to elevate privileges locally.9hCVE-2026-1137527.5 HIG—
——0Use after free in Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network.9hCVE-2026-1137517.0 HIG—
——0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.9hCVE-2024-7804——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26dCVE-2026-1129795.5 MED—
——0Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally.9hCVE-2026-25094——
——0Rejected reason: Not used24dCVE-2018-4720——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2026-35060——
——0Missing authentication for critical function for some AI Playground software before version v3.1.1-beta within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8h