CVE Watch404,084 en archivo total

Vulnerabilidades explotables hoy

16,780en la vista actual

Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.

En catálogo KEV1,758

Nuevos KEV · 24H0

Exploit Today ≥ 701,691

Distribución · última ventana

Crítico
5,635
Alto
21,783
Medio
20,206
Bajo
2,118

Filtros

Ventana

Severidad

Filtros

Vulnerabilidades8,801–8,840 · 16,780

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-876967.5 ALT

36.9%

——11Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.7h CVE-2026-876957.8 ALT

22.4%

——7Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.7h CVE-2026-876947.8 ALT

29.7%

——9Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.7h CVE-2026-876937.0 ALT

17.3%

——5Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.11d CVE-2026-876927.8 ALT

76.8%

——23Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.14d CVE-2026-876917.8 ALT

15.6%

——5Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.14d CVE-2026-86063—

6.5%

——2Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.14d CVE-2026-859457.8 ALT

30.6%

——9Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.11d CVE-2026-859437.0 ALT

12.3%

——4Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.11d CVE-2026-859417.0 ALT

14.1%

——4Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.11d CVE-2026-859395.3 MED

31.5%

——9Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.11d CVE-2026-859385.5 MED

27.5%

——8Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.11d CVE-2026-859368.8 ALT

46.2%

——14Double free in Windows Shell allows an unauthorized attacker to execute code over a network.11d CVE-2026-859355.5 MED

33.6%

——10Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally.11d CVE-2026-859347.0 ALT

16.5%

——5Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.11d CVE-2026-859337.8 ALT

15.6%

——5Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.11d CVE-2026-859326.5 MED

67.6%

——20Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.13d CVE-2026-859318.8 ALT

57.9%

——17Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.11d CVE-2026-859307.0 ALT

10.2%

——3Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.11d CVE-2026-859289.8 CRÍ

50.8%

——15Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.11d CVE-2026-859277.8 ALT

24.5%

——7Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.11d CVE-2026-859268.1 ALT

51.3%

——15Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.11d CVE-2026-859258.2 ALT

44.2%

——13Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.11d CVE-2026-859227.4 ALT

48.8%

——15Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.11d CVE-2026-859207.0 ALT

4.9%

——1Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.11d CVE-2026-859187.0 ALT

15.7%

——5Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.11d CVE-2026-859166.2 MED

36.5%

——11Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.11d CVE-2026-859157.8 ALT

23.7%

——7Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.11d CVE-2026-859147.0 ALT

9.6%

——3Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.11d CVE-2026-859127.0 ALT

8.6%

——3Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.1d CVE-2026-859117.8 ALT

29.7%

——9Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.1d CVE-2026-859105.5 MED

38.9%

——12Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.1d CVE-2026-859095.5 MED

38.9%

——12Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.1d CVE-2026-859087.8 ALT

37.4%

——11Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.11d CVE-2026-859067.8 ALT

28.2%

——8Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.11d CVE-2026-859058.8 ALT

29.7%

——9Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.11d CVE-2026-859047.0 ALT

4.4%

——1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.11d CVE-2026-859038.8 ALT

53.0%

——16Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.11d CVE-2026-859027.8 ALT

32.0%

——10Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.11d CVE-2026-859017.8 ALT

35.0%

——10Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.11d