Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-32202KEVexploit ×4 | 4.3 medium | 71.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2020-1054KEVexploit ×5 | 7.0 high | 54.0% | microsoft, windows_10_1507, windows_10_1607, windows_10_1709 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory. | 8 Oct |
| CVE-2025-60710KEVexploit ×2 | 7.8 high | 5.0% | microsoft, windows_11_24h2, windows_11_25h2, windows_server_2025 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. | 18 Oct |
| CVE-2026-68820KEVexploit ×4 | 7.0 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-41089exploit ×12 | 9.8 critical | 80.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2004-0230exploit ×7 | 5.0 medium | 80.0% | juniper, microsoft, junos, windows_2000, windows_98 | TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. | 9 Oct |
| CVE-2011-3389exploit ×2 | 4.3 medium | 73.0% | google, microsoft, chrome, internet_explorer, firefox | The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. | 9 Oct |
| CVE-2025-13315exploit ×2 | 9.3 critical | 31.0% | lynxtechnology, twonky_server | Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password. | 18 Oct |
| CVE-2017-8529exploit | 6.5 medium | 14.0% | microsoft, internet_explorer, edge | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in memory, aka "Microsoft Browser Information Disclosure Vulnerability". | 8 Oct |
| CVE-2023-20178exploit | 7.8 high | 5.0% | cisco, anyconnect_secure_mobility_client, secure_client | A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges. | 8 Oct |
| CVE-2026-33829exploit ×3 | 4.3 medium | 4.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network. | 14 Oct |
| CVE-2025-13316exploit | 8.2 high | 3.0% | lynxtechnology, twonky_server | Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server. | 18 Oct |
| CVE-2024-28757exploit ×2 | 7.5 high | 2.0% | libexpat_project, fedoraproject, libexpat, fedora, active_iq_unified_manager | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). | 15 Oct |
| CVE-2026-58057exploit ×2 | 2.3 low | 2.0% | flowiseai, flowise | Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can thereby inject NODE_OPTIONS --require and execute arbitrary code in the Flowise server context. | Sun 25 Oct |
| CVE-2026-56190exploit ×2 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. | 8 h ago |
| CVE-2026-62878exploit | 9.8 critical | 1.0% | microsoft, windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 | Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. | 8 h ago |
| CVE-2026-54121exploit ×15 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. | 8 h ago |
| CVE-2026-50369exploit | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network. | 8 h ago |
| CVE-2026-49179exploit | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network. | Sat 24 Oct |
| CVE-2026-53571exploit | 8.2 high | 1.0% | vitejs, voidzero, vite, vite\+ | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3. | Sun 25 Oct |
| CVE-2026-33827exploit | 8.1 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | 14 Oct |
| CVE-2025-59489exploit ×2 | 7.4 high | 1.0% | unity, editor | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications. | 8 Oct |
| CVE-2026-11417exploit | 7.0 high | 1.0% | no CPE yet | OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application. To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later. | Mon 26 Oct |
| CVE-2022-26488exploit | 7.0 high | 1.0% | python, netapp, active_iq_unified_manager, ontap_select_deploy_administration_utility | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2. | 14 Oct |
| CVE-2026-34348exploit | 6.5 medium | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network. | 8 h ago |
| CVE-2026-47429exploit | 5.9 medium | 1.0% | vitest.dev, vitest | Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0. | Sat 24 Oct |
| CVE-2024-50602exploit | 5.9 medium | 1.0% | netapp, debian, active_iq_unified_manager, solidfire_\&_hci_management_node, solidfire_\&_hci_storage_node | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. | 15 Oct |
| CVE-2025-59284exploit | 5.5 medium | 1.0% | microsoft, windows_11_22h2, windows_11_23h2, windows_11_24h2 | Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. | 18 Oct |
| CVE-2026-55780exploit | 2.4 low | 1.0% | no CPE yet | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause an attacker-chosen allocation inside Extract, where std::bad_alloc or std::length_error can escape across the COM STDMETHODCALLTYPE boundary and crash the process. This issue is fixed in version 6.5.1749.0. | Sun 25 Oct |
| CVE-2026-54107exploit | 8.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-49492exploit | 8.6 high | 0.00% | no CPE yet | Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use. | Mon 26 Oct |
| CVE-2026-7791exploit | 8.5 high | 0.00% | no CPE yet | Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations bypassing file system permission protections, leading to local privilege escalation to SYSTEM. | Mon 26 Oct |
| CVE-2026-8069exploit | 8.5 high | 0.00% | acer, nitrosense, predatorsense | PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges. | Mon 26 Oct |
| CVE-2026-54992exploit | 8.4 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally. | 8 h ago |
| CVE-2026-54424exploit | 8.4 high | 0.00% | no CPE yet | An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable. | Sun 25 Oct |
| CVE-2026-27912exploit ×3 | 8.0 high | 0.00% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network. | Mon 26 Oct |
| CVE-2026-62737exploit ×2 | 7.8 high | 0.00% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-62735exploit ×2 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-54984exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally. | 8 h ago |
| CVE-2026-50402exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-50343exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-58635exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-49176exploit ×2 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. | 8 h ago |
| CVE-2026-26179exploit | 7.8 high | 0.00% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Double free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-66804exploit ×4 | 7.8 high | 0.00% | microsoft, windows 10 version 22h2, windows 11 version 24h2, windows 11 version 25h2 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. | 21 Oct |
| CVE-2026-85884exploit | 7.8 high | 0.00% | no CPE yet | Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-97798exploit | 7.8 high | 0.00% | microsoft, windows_10_21h2, windows_10_22h2, windows_11_23h2 | Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 16 Oct |
| CVE-2025-40271exploit ×3 | 7.8 high | 0.00% | no CPE yet | In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) | 15 Oct |
| CVE-2026-42141exploit | 7.7 high | 0.00% | no CPE yet | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1. | Mon 26 Oct |
| CVE-2026-32996exploit | 7.3 high | 0.00% | no CPE yet | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | Mon 26 Oct |
50 of 62 · Next
Download these 62 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.