Vulnerabilities exploitable today
16,288in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,435
- High15,664
- Medium14,704
- Low1,444
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-838886.5 MED58.8%
——18Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.6dCVE-2026-838875.5 MED30.8%
——9Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838867.0 HIG21.1%
——6Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.8dCVE-2026-838855.6 MED8.2%
——2Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.9dCVE-2026-838845.5 MED32.5%
——10Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838837.8 HIG26.3%
——8Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.6dCVE-2026-838827.8 HIG26.3%
——8Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.6dCVE-2026-838817.8 HIG26.3%
——8Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.6dCVE-2026-838797.0 HIG10.3%
——3Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.6dCVE-2026-838777.8 HIG26.3%
——8Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.6dCVE-2026-838767.8 HIG26.3%
——8Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.5dCVE-2026-838755.5 MED20.6%
——6Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838748.8 HIG55.0%
——17Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.6dCVE-2026-838737.8 HIG27.7%
——8Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.5dCVE-2026-838727.8 HIG23.5%
——7Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.6dCVE-2026-838717.0 HIG9.2%
——3Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.6dCVE-2026-838705.5 MED32.6%
——10Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally.9dCVE-2026-838699.8 CRI49.7%
——15Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.6dCVE-2026-838687.0 HIG5.0%
——1Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.6dCVE-2026-838677.8 HIG29.6%
——9Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.6dCVE-2026-838667.0 HIG15.7%
——5Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.6dCVE-2026-838654.7 MED18.6%
——6Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.6dCVE-2026-838645.5 MED26.4%
——8Improper access control in Windows NTFS allows an authorized attacker to disclose information locally.6dCVE-2026-838637.8 HIG23.5%
——7Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.6dCVE-2026-838629.8 CRI50.4%
——15Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over a network.8dCVE-2026-838617.8 HIG23.5%
——7Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.6dCVE-2026-838607.5 HIG66.6%
——20Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.6dCVE-2026-838597.8 HIG23.5%
——7Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.6dCVE-2026-838577.8 HIG23.5%
——7Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.6dCVE-2026-838567.5 HIG46.3%
——14Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.9dCVE-2026-838557.5 HIG67.9%
——20Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.9dCVE-2026-838545.5 MED17.3%
——5Improper access control in Windows Notification allows an authorized attacker to disclose information locally.6dCVE-2026-838537.0 HIG15.7%
——5Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.6dCVE-2026-838527.0 HIG9.8%
——3Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.9dCVE-2026-838518.8 HIG48.3%
——15Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.6dCVE-2026-838507.8 HIG23.5%
——7Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.6dCVE-2026-838495.5 MED32.6%
——10Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally.6dCVE-2026-838487.8 HIG29.6%
——9Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.6dCVE-2026-838477.8 HIG22.1%
——7Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.6dCVE-2026-838467.0 HIG14.5%
——4Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.6d