CVE Watch401,677 in full archive

Vulnerabilities exploitable today

16,467in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,666

Distribution · last window

Critical
3,400
High
15,532
Medium
14,795
Low
1,422

Filters

Window

Severity

Flags

Vulnerabilities7,401–7,440 · 16,467

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1035675.5 MED

32.6%

——10Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.7d CVE-2026-1035657.0 HIG

15.7%

——5Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.7d CVE-2026-1035605.5 MED

19.5%

——6Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.7d CVE-2026-1035587.5 HIG

58.7%

——18Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.7d CVE-2026-1035557.0 HIG

15.7%

——5Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.7d CVE-2026-1035547.0 HIG

15.7%

——5Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.7d CVE-2026-1035537.8 HIG

23.5%

——7Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.7d CVE-2026-1028708.8 HIG

55.3%

——17Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.9d CVE-2026-1028698.8 HIG

54.0%

——16Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.9d CVE-2026-1028676.5 MED

58.5%

——18Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.8d CVE-2026-1028668.1 HIG

44.5%

——13Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.9d CVE-2026-1028656.5 MED

55.2%

——17Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.9d CVE-2026-1028644.6 MED

28.9%

——9Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.9d CVE-2026-1028638.8 HIG

58.8%

——18Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.9d CVE-2026-1028628.8 HIG

52.5%

——16Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.9d CVE-2026-1028618.8 HIG

52.5%

——16Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.9d CVE-2026-1028608.8 HIG

52.5%

——16Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.9d CVE-2026-1028594.6 MED

28.9%

53.4%

——16Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.7d CVE-2026-1028578.8 HIG

55.4%

——17Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.8d CVE-2026-1028568.8 HIG

55.4%

——17Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.8d CVE-2026-1028516.1 MED

16.5%

——5Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.9d CVE-2026-1028508.8 HIG

49.3%

——15Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.8d CVE-2026-1028498.8 HIG

49.3%

——15Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.8d CVE-2026-1025997.5 HIG

47.1%

——14Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.6d CVE-2026-1022337.8 HIG

35.3%

——11Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.7d CVE-2026-1022327.0 HIG

25.3%

——8Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.9d CVE-2026-1022317.7 HIG

30.5%

——9Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.7d CVE-2026-1022296.8 MED

60.3%

——18Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.9d CVE-2026-1022277.8 HIG

23.5%

——7Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.7d CVE-2026-1022268.8 HIG

59.8%

——18Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.9d CVE-2026-1022258.8 HIG

56.0%

——17Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.7d CVE-2026-1022214.4 MED

23.6%

——7No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.7d CVE-2026-1022207.8 HIG

23.5%

——7Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.7d CVE-2026-1022187.8 HIG

23.5%

——7Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.7d CVE-2026-1022178.8 HIG

65.7%

——20Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.2d CVE-2026-1022167.8 HIG

23.5%

——7Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.2d CVE-2026-1022157.8 HIG

23.5%

——7Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.2d CVE-2026-1022148.8 HIG

25.0%

——7Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.2d CVE-2026-1022117.0 HIG

8.5%

——3Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.3d