CVE Watch401,677 in full archive

Vulnerabilities exploitable today

16,655in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,666

Distribution · last window

Critical
3,410
High
15,620
Medium
14,869
Low
1,427

Filters

Window

Severity

Flags

Vulnerabilities6,441–6,480 · 16,655

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-859268.1 HIG

50.9%

——15Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.6d CVE-2026-859258.2 HIG

39.1%

——12Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.6d CVE-2026-859227.4 HIG

44.4%

——13Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.6d CVE-2026-859207.0 HIG

4.5%

——1Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.6d CVE-2026-859187.0 HIG

14.9%

——4Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.6d CVE-2026-859166.2 MED

35.7%

——11Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.6d CVE-2026-859157.8 HIG

22.6%

——7Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.6d CVE-2026-859147.0 HIG

9.2%

——3Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.6d CVE-2026-859127.0 HIG

3.9%

——1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.6d CVE-2026-859117.8 HIG

23.5%

——7Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.6d CVE-2026-859105.5 MED

32.6%

——10Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.9d CVE-2026-859095.5 MED

32.6%

——10Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.6d CVE-2026-859087.8 HIG

28.0%

——8Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.6d CVE-2026-859067.8 HIG

18.9%

——6Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.6d CVE-2026-859058.8 HIG

23.5%

——7Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.6d CVE-2026-859047.0 HIG

4.1%

——1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.6d CVE-2026-859038.8 HIG

44.9%

——13Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.6d CVE-2026-859027.8 HIG

25.7%

——8Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.6d CVE-2026-859017.8 HIG

28.6%

——9Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.6d CVE-2026-859008.8 HIG

74.3%

——22Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.8d CVE-2026-858917.5 HIG

60.0%

——18Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.9d CVE-2026-858847.8 HIG

32.4%

——10Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.9d CVE-2026-858818.0 HIG

51.6%

——15Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.9d CVE-2026-858797.0 HIG

8.5%

——3Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.9d CVE-2026-858747.8 HIG

23.5%

——7Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.6d CVE-2026-858736.5 MED

56.9%

——17Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.6d CVE-2026-858727.8 HIG

15.7%

——5Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.6d CVE-2026-858717.8 HIG

23.5%

——7Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.6d CVE-2026-858707.0 HIG

20.1%

——6Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.6d CVE-2026-858697.8 HIG

23.5%

——7Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.6d CVE-2026-858687.0 HIG

15.7%

——5Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.6d CVE-2026-858677.8 HIG

14.9%

——4Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.6d CVE-2026-858664.7 MED

20.6%

——6Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.6d CVE-2026-858655.5 MED

20.2%

——6Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.9d CVE-2026-858647.8 HIG

54.2%

——16Improper privilege management in Python allows an authorized attacker to elevate privileges locally.6d CVE-2026-858637.8 HIG

14.5%

——4Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.6d CVE-2026-858617.8 HIG

14.5%

——4Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.6d CVE-2026-858607.8 HIG

14.9%

——4Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.6d CVE-2026-858596.5 MED

55.8%

——17Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.6d CVE-2026-858587.8 HIG

15.7%

——5Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.9d