Vulnerabilities exploitable today
16,556in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,401
- High15,535
- Medium14,799
- Low1,423
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-838537.0 HIG15.7%
——5Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.6dCVE-2026-838527.0 HIG9.8%
——3Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.9dCVE-2026-838518.8 HIG48.3%
——15Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.6dCVE-2026-838507.8 HIG23.5%
——7Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.6dCVE-2026-838495.5 MED32.6%
——10Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally.6dCVE-2026-838487.8 HIG29.6%
——9Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.6dCVE-2026-838477.8 HIG22.1%
——7Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.6dCVE-2026-838467.0 HIG14.5%
——4Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.6dCVE-2026-838458.4 HIG20.1%
——6Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.6dCVE-2026-838448.1 HIG50.4%
——15Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.9dCVE-2026-838437.5 HIG66.6%
——20Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.6dCVE-2026-838427.0 HIG17.8%
——5Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.6dCVE-2026-838417.0 HIG8.5%
——3Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.6dCVE-2026-838407.8 HIG24.8%
——7Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.6dCVE-2026-838397.0 HIG8.5%
——3Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.6dCVE-2026-838388.0 HIG41.0%
——12Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.6dCVE-2026-838377.8 HIG19.8%
——6Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.6dCVE-2026-838367.8 HIG37.6%
——11Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.6dCVE-2026-838355.5 MED39.6%
——12Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.6dCVE-2026-838347.0 HIG10.0%
——3Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.6dCVE-2026-838337.8 HIG23.5%
——7Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.6dCVE-2026-838327.8 HIG23.5%
——7Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.6dCVE-2026-838307.8 HIG29.6%
——9Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.6dCVE-2026-838297.8 HIG23.5%
——7Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.6dCVE-2026-838287.8 HIG23.5%
——7Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.9dCVE-2026-838277.0 HIG15.7%
——5Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.6dCVE-2026-838267.8 HIG23.5%
——7Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.9dCVE-2026-837985.5 MED11.3%
——3Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.6dCVE-2026-837978.8 HIG55.0%
——17Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.6dCVE-2026-837967.8 HIG23.5%
——7Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.9dCVE-2026-837957.5 HIG66.6%
——20Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.6dCVE-2026-837945.5 MED32.6%
——10Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized attacker to disclose information locally.6dCVE-2026-837937.0 HIG20.1%
——6Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.6dCVE-2026-837927.8 HIG19.8%
——6Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.6dCVE-2026-837917.8 HIG19.8%
——6Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.6dCVE-2026-837907.0 HIG15.7%
——5Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.6dCVE-2026-837898.8 HIG55.0%
——17Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.6dCVE-2026-837884.6 MED38.7%
——12Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack.6dCVE-2026-837875.5 MED20.2%
——6Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.8dCVE-2026-837864.7 MED28.7%
——9Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.6d