CVE Watch401,110 in full archive

Vulnerabilities exploitable today

16,350in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,666

Distribution · last window

Critical
3,437
High
15,692
Medium
14,714
Low
1,445

Filters

Window

Severity

Flags

Vulnerabilities5,841–5,880 · 16,350

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-877095.5 MED

15.3%

——5Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally.6d CVE-2026-877087.0 HIG

15.7%

——5Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.6d CVE-2026-877077.8 HIG

14.9%

——4Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.9d CVE-2026-877067.8 HIG

14.9%

——4Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.9d CVE-2026-877057.4 HIG

27.2%

——8Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.6d CVE-2026-877047.0 HIG

9.8%

——3Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.6d CVE-2026-877027.8 HIG

23.5%

——7Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.6d CVE-2026-877007.8 HIG

14.9%

——4Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.6d CVE-2026-876997.8 HIG

23.5%

——7Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.6d CVE-2026-876985.5 MED

22.1%

——7Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally.6d CVE-2026-876978.8 HIG

57.5%

——17Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.8d CVE-2026-876967.5 HIG

30.6%

——9Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.8d CVE-2026-876957.8 HIG

13.7%

——4Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.8d CVE-2026-876947.8 HIG

23.5%

——7Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.6d CVE-2026-876937.0 HIG

9.8%

——3Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.6d CVE-2026-876927.8 HIG

75.4%

——23Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.9d CVE-2026-876917.8 HIG

14.9%

——4Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.9d CVE-2026-86063—

6.2%

——2Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.9d CVE-2026-859457.8 HIG

29.6%

——9Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.6d CVE-2026-859437.0 HIG

8.5%

——3Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.6d CVE-2026-859417.0 HIG

10.0%

——3Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.6d CVE-2026-859395.3 MED

30.5%

——9Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.6d CVE-2026-859385.5 MED

26.4%

——8Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.6d CVE-2026-859368.8 HIG

45.6%

——14Double free in Windows Shell allows an unauthorized attacker to execute code over a network.5d CVE-2026-859355.5 MED

32.6%

——10Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally.6d CVE-2026-859347.0 HIG

15.7%

——5Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.6d CVE-2026-859337.8 HIG

14.9%

——4Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.6d CVE-2026-859326.5 MED

63.8%

——19Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.8d CVE-2026-859318.8 HIG

57.7%

——17Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.6d CVE-2026-859307.0 HIG

9.8%

——3Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.6d CVE-2026-859289.8 CRI

50.4%

——15Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.6d CVE-2026-859277.8 HIG

23.5%

——7Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.6d CVE-2026-859268.1 HIG

50.9%

——15Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.6d CVE-2026-859258.2 HIG

39.1%

——12Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.6d CVE-2026-859227.4 HIG

44.4%

——13Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.6d CVE-2026-859207.0 HIG

4.5%

——1Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.6d CVE-2026-859187.0 HIG

14.9%

——4Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.6d CVE-2026-859166.2 MED

35.7%

——11Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.6d CVE-2026-859157.8 HIG

22.6%

——7Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.6d CVE-2026-859147.0 HIG

9.2%

——3Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.6d