Vulnerabilities exploitable today
16,595in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,401
- High15,535
- Medium14,802
- Low1,423
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-838985.5 MED30.8%
——9Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838974.7 MED28.7%
——9Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.6dCVE-2026-838967.8 HIG28.0%
——8Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.6dCVE-2026-838956.8 MED37.9%
——11Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elevate privileges with a physical attack.6dCVE-2026-838935.5 MED41.2%
——12Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose information locally.6dCVE-2026-838925.5 MED32.5%
——10Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838918.8 HIG54.6%
——16Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.7dCVE-2026-838898.8 HIG59.7%
——18Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.6dCVE-2026-838886.5 MED58.8%
——18Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.6dCVE-2026-838875.5 MED30.8%
——9Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838867.0 HIG21.1%
——6Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.9dCVE-2026-838855.6 MED8.2%
——2Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.9dCVE-2026-838845.5 MED32.5%
——10Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838837.8 HIG26.3%
——8Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.6dCVE-2026-838827.8 HIG26.3%
——8Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.6dCVE-2026-838817.8 HIG26.3%
——8Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.6dCVE-2026-838797.0 HIG10.3%
——3Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.6dCVE-2026-838777.8 HIG26.3%
——8Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.6dCVE-2026-838767.8 HIG26.3%
——8Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.1dCVE-2026-838755.5 MED20.6%
——6Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.6dCVE-2026-838748.8 HIG55.0%
——17Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.1dCVE-2026-838737.8 HIG27.7%
——8Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.1dCVE-2026-838727.8 HIG23.5%
——7Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.1dCVE-2026-838717.0 HIG9.2%
——3Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.1dCVE-2026-838705.5 MED32.6%
——10Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally.1dCVE-2026-838699.8 CRI49.7%
——15Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.6dCVE-2026-838687.0 HIG5.0%
——1Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.6dCVE-2026-838677.8 HIG29.6%
——9Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.1dCVE-2026-838667.0 HIG15.7%
——5Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.6dCVE-2026-838654.7 MED18.6%
——6Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.6dCVE-2026-838645.5 MED26.4%
——8Improper access control in Windows NTFS allows an authorized attacker to disclose information locally.6dCVE-2026-838637.8 HIG23.5%
——7Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.6dCVE-2026-838629.8 CRI50.4%
——15Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over a network.9dCVE-2026-838617.8 HIG23.5%
——7Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.6dCVE-2026-838607.5 HIG66.6%
——20Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.6dCVE-2026-838597.8 HIG23.5%
——7Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.6dCVE-2026-838577.8 HIG23.5%
——7Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.6dCVE-2026-838567.5 HIG46.3%
——14Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.9dCVE-2026-838557.5 HIG67.9%
——20Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.9dCVE-2026-838545.5 MED17.3%
——5Improper access control in Windows Notification allows an authorized attacker to disclose information locally.6d