Vulnerabilities exploitable today
16,595in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,401
- High15,535
- Medium14,802
- Low1,423
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-840094.7 MED8.9%
——3Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.3dCVE-2026-840087.5 HIG55.0%
——16Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.9dCVE-2026-840076.5 MED62.3%
——19Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attacker to disclose information over a network.3dCVE-2026-839359.8 CRI51.8%
——16Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.3dCVE-2026-839348.8 HIG55.4%
——17Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.3dCVE-2026-839335.5 MED35.8%
——11Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.6dCVE-2026-839327.8 HIG26.3%
——8Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.6dCVE-2026-839317.8 HIG18.1%
——5Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.9dCVE-2026-839307.0 HIG11.7%
——4Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.9dCVE-2026-839298.8 HIG48.3%
——15Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.6dCVE-2026-839288.8 HIG46.8%
——14Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.6dCVE-2026-839277.8 HIG32.5%
——10Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.6dCVE-2026-839264.4 MED32.6%
——10Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.6dCVE-2026-839254.7 MED30.4%
——9Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.6dCVE-2026-839247.0 HIG18.1%
——5Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.6dCVE-2026-839238.8 HIG59.9%
——18Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.6dCVE-2026-839227.8 HIG26.3%
——8Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.6dCVE-2026-839217.0 HIG19.0%
——6Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.6dCVE-2026-839207.8 HIG17.2%
——5Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.6dCVE-2026-839197.8 HIG15.9%
——5Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.6dCVE-2026-839187.8 HIG17.2%
——5Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.6dCVE-2026-839177.0 HIG12.2%
——4Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.6dCVE-2026-839167.0 HIG18.1%
——5Double free in Windows Error Reporting allows an authorized attacker to execute code locally.6dCVE-2026-839157.0 HIG18.1%
——5Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.6dCVE-2026-839148.1 HIG53.4%
——16Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.6dCVE-2026-839137.8 HIG26.3%
——8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.6dCVE-2026-839127.8 HIG17.2%
——5Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.6dCVE-2026-839117.0 HIG18.1%
——5Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.6dCVE-2026-839109.8 CRI61.1%
——18Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.6dCVE-2026-839094.7 MED30.4%
——9Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.6dCVE-2026-839087.0 HIG18.1%
——5Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.6dCVE-2026-839075.5 MED41.2%
——12Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.6dCVE-2026-839066.5 MED59.0%
——18Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network.9dCVE-2026-839054.7 MED30.4%
——9Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.6dCVE-2026-839045.5 MED30.8%
——9Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-839037.8 HIG26.3%
——8Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.9dCVE-2026-839027.8 HIG28.0%
——8Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.6dCVE-2026-839017.0 HIG18.1%
——5Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.6dCVE-2026-839007.0 HIG18.1%
——5Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.9dCVE-2026-838997.0 HIG10.9%
——3Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.6d