CVE Watch371,523 in full archive

Vulnerabilities exploitable today

371,523in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,695

New KEV · 24H0

Exploit Today ≥ 701,637

Distribution · last window

Critical
2,229
High
8,605
Medium
6,351
Low
586

Filters

Window

Severity

Flags

Vulnerabilities369,761–369,800 · 371,523

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-87650—

—

———Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)7h CVE-2026-693616.5 MED

—

———Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.13h CVE-2026-693608.8 HIG

—

———Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.4h CVE-2026-693597.8 HIG

—

———Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to elevate privileges locally.4h CVE-2026-693587.1 HIG

—

———Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.3h CVE-2026-693577.1 HIG

—

———Use after free in Windows NDIS allows an authorized attacker to elevate privileges over a network.13h CVE-2026-693569.3 CRI

—

———Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.13h CVE-2026-693558.8 HIG

—

———External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.4h CVE-2026-693535.5 MED

—

———Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disclose information locally.12h CVE-2026-693527.8 HIG

—

———Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.13h CVE-2026-693506.7 MED

—

———Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.4h CVE-2026-693495.7 MED

—

———Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network.11h CVE-2026-693487.8 HIG

—

———Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.4h CVE-2026-693477.4 HIG

—

———Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.3h CVE-2026-87651—

—

———Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)7h CVE-2026-693455.5 MED

—

———Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.11h CVE-2026-693445.5 MED

—

———Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.12h CVE-2026-693435.5 MED

—

———Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally.13h CVE-2026-87652—

—

———Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)7h CVE-2026-87653—

—

———UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)7h CVE-2026-693427.5 HIG

—

———Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.11h CVE-2026-693417.0 HIG

—

———Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.3h CVE-2026-693407.1 HIG

—

———Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.4h CVE-2026-693395.5 MED

—

———Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.11h CVE-2026-693387.1 HIG

—

———Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.3h CVE-2026-87654—

—

———Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)7h CVE-2026-87655—

—

———Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)7h CVE-2026-693377.1 HIG

—

———Double free in Windows Registry allows an authorized attacker to elevate privileges over a network.4h CVE-2026-693367.1 HIG

—

———Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.13h CVE-2026-693357.0 HIG

—

———Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.4h CVE-2026-87656—

—

———Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)7h CVE-2026-693348.8 HIG

—

———Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.13h CVE-2026-693337.0 HIG

—

———Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.4h CVE-2026-693328.0 HIG

—

———Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network.4h CVE-2026-693317.0 HIG

—

———Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.4h CVE-2026-87657—

—

———Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)7h CVE-2026-87658—

—

———Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)7h CVE-2026-870835.5 MED

—

———A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This patch is called 11ec2397fe942e8b422d026af4a03d6e0a55ae6c. Applying a patch is advised to resolve this issue. Based on the release information, the fix has not been included in any official release yet.6h CVE-2026-877246.5 MED

—

———Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.6h CVE-2026-693297.5 HIG

—

———Out-of-bounds read in BranchCache allows an unauthorized attacker to deny service over a network.11h