BaselineWatch
58257 CVEs · 127 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,257 New, 24 h1,147 Changed, 24 h2,265 In KEV127 Public exploit1,578 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-54983 7.5 high 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. 17 h ago
CVE-2026-50506 7.5 high 1.0% microsoft, aspnet.odata, aspnetcore.odata Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. 17 h ago
CVE-2026-47296 7.5 high 1.0% microsoft, microsoft sql server 2016 service pack 3 (gdr), microsoft sql server 2016 service pack 3 azure connect feature pack, microsoft sql server 2017 (cu 31) Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. 17 h ago
CVE-2023-22839 7.5 high 1.0% f5, big-ip_domain_name_system, big-ip_local_traffic_manager, big-ip_10000s_firmware On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. 18 h ago
CVE-2023-54219 7.5 high 1.0% no CPE yet In the Linux kernel, the following vulnerability has been resolved: Revert "IB/isert: Fix incorrect release of isert connection" Commit: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") is causing problems on OPA when DEVICE_REMOVAL is happening. ------------[ cut here ]------------ WARNING: CPU: 52 PID: 2117247 at drivers/infiniband/core/cq.c:359 ib_cq_pool_cleanup+0xac/0xb0 [ib_core] Modules linked in: nfsd nfs_acl target_core_user uio tcm_fc libfc scsi_transport_fc tcm_loop target_core_pscsi target_core_iblock target_core_file rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill rpcrdma rdma_ucm ib_srpt sunrpc ib_isert iscsi_target_mod target_core_mod opa_vnic ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm ib_cm hfi1(-) rdmavt ib_uverbs intel_rapl_msr intel_rapl_common sb_edac ib_core x86_pkg_temp_thermal intel_powerclamp coretemp i2c_i801 mxm_wmi rapl iTCO_wdt ipmi_si iTCO_vendor_support mei_me ipmi_devintf mei intel_cstate ioatdma intel_uncore i2c_smbus joydev pcspkr lpc_ich ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel drm_kms_helper drm_shmem_helper ahci libahci ghash_clmulni_intel igb drm libata dca i2c_algo_bit wmi fuse CPU: 52 PID: 2117247 Comm: modprobe Not tainted 6.5.0-rc1+ #1 Hardware name: Intel Corporation S2600CWR/S2600CW, BIOS SE5C610.86B.01.01.0014.121820151719 12/18/2015 RIP: 0010:ib_cq_pool_cleanup+0xac/0xb0 [ib_core] Code: ff 48 8b 43 40 48 8d 7b 40 48 83 e8 40 4c 39 e7 75 b3 49 83 c4 10 4d 39 fc 75 94 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <0f> 0b eb a1 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f RSP: 0018:ffffc10bea13fc80 EFLAGS: 00010206 RAX: 000000000000010c RBX: ffff9bf5c7e66c00 RCX: 000000008020001d RDX: 000000008020001e RSI: fffff175221f9900 RDI: ffff9bf5c7e67640 RBP: ffff9bf5c7e67600 R08: ffff9bf5c7e64400 R09: 000000008020001d R10: 0000000040000000 R11: 0000000000000000 R12: ffff9bee4b1e8a18 R13: dead000000000122 R14: dead000000000100 R15: ffff9bee4b1e8a38 FS: 00007ff1e6d38740(0000) GS:ffff9bfd9fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005652044ecc68 CR3: 0000000889b5c005 CR4: 00000000001706e0 Call Trace: <TASK> ? __warn+0x80/0x130 ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] ? report_bug+0x195/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] disable_device+0x9d/0x160 [ib_core] __ib_unregister_device+0x42/0xb0 [ib_core] ib_unregister_device+0x22/0x30 [ib_core] rvt_unregister_device+0x20/0x90 [rdmavt] hfi1_unregister_ib_device+0x16/0xf0 [hfi1] remove_one+0x55/0x1a0 [hfi1] pci_device_remove+0x36/0xa0 device_release_driver_internal+0x193/0x200 driver_detach+0x44/0x90 bus_remove_driver+0x69/0xf0 pci_unregister_driver+0x2a/0xb0 hfi1_mod_cleanup+0xc/0x3c [hfi1] __do_sys_delete_module.constprop.0+0x17a/0x2f0 ? exit_to_user_mode_prepare+0xc4/0xd0 ? syscall_trace_enter.constprop.0+0x126/0x1a0 do_syscall_64+0x5c/0x90 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? exc_page_fault+0x65/0x150 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7ff1e643f5ab Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffec9103cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 00005615267fdc50 RCX: 00007ff1e643f5ab RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005615267fdcb8 RBP: 00005615267fdc50 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ff1e659eac0 R11: 0000000000000206 R12: 00005615267fdcb8 R13: 00000000000 ---truncated--- 18 h ago
CVE-2025-66974 7.5 high 1.0% no CPE yet An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase. 23 h ago
CVE-2026-55126 7.3 high 1.0% microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. 17 h ago
CVE-2026-55034 7.3 high 1.0% microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. 17 h ago
CVE-2026-55021 7.3 high 1.0% microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. 17 h ago
CVE-2026-56171 7.1 high 1.0% microsoft, remote desktop web client, windows admin center Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-55122 7.1 high 1.0% microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. 17 h ago
CVE-2026-50682 7.1 high 1.0% microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network. 17 h ago
CVE-2026-58528 6.8 medium 1.0% microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. 17 h ago
CVE-2026-50426 6.8 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network. 17 h ago
CVE-2026-58539 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-58546 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-58535 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-58533 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-57982 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. 17 h ago
CVE-2026-56168 6.5 medium 1.0% microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network. 17 h ago
CVE-2026-54116 6.5 medium 1.0% microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network. 17 h ago
CVE-2026-50468 6.5 medium 1.0% microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. 17 h ago
CVE-2026-55051 6.5 medium 1.0% microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. 17 h ago
CVE-2026-55054 6.5 medium 1.0% microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-54126 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-50504 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-50497 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-50445 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-50376 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-50366 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. 17 h ago
CVE-2026-49799 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. 17 h ago
CVE-2026-57979 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2026-57976 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. 17 h ago
CVE-2026-54108 6.5 medium 1.0% microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. 17 h ago
CVE-2026-55003 6.5 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. 17 h ago
CVE-2023-0697 6.5 medium 1.0% google, chrome Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: High) 18 h ago
CVE-2023-0704 6.5 medium 1.0% google, chrome Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low) 18 h ago
CVE-2023-0749 6.5 medium 1.0% oceanwp, ocean_extra The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones. 18 h ago
CVE-2023-25166 6.5 medium 1.0% hapi, formula formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability. 18 h ago
CVE-2023-27270 6.5 medium 1.0% sap, netweaver_application_server_abap SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information. 18 h ago
CVE-2023-31101 6.5 medium 1.0% apache, inlong Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 to solve it. 18 h ago
CVE-2026-57097 6.4 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack. 17 h ago
CVE-2026-49807 6.2 medium 1.0% microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally. 17 h ago
CVE-2026-50294 6.2 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. 17 h ago
CVE-2026-50453 6.1 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. 17 h ago
CVE-2023-0606 6.1 medium 1.0% ampache Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. 18 h ago
CVE-2023-42343 6.1 medium 1.0% no CPE yet A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. 18 h ago
CVE-2026-56649 5.9 medium 1.0% microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network. 17 h ago
CVE-2026-50324 5.9 medium 1.0% microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. 17 h ago
CVE-2026-57084 5.5 medium 1.0% microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. 17 h ago

200 of 1147 · Next · Previous

Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.

EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.