Vulnerabilities
Tracked app vulnerabilities
4,361 CVEs affect a tracked app or OS (Medium, Windows). 21 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 4,361
- Actively exploited
- 21
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-97015
MEDIUM 6.8
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
|
CVE-2026-97006
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96992
MEDIUM 6.4
Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96989
MEDIUM 5.5
Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally. |
|
CVE-2026-96988
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96987
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96986
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96985
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96984
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96983
MEDIUM 5.3
Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network. |
|
CVE-2026-96982
MEDIUM 6.8
Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96981
MEDIUM 6.4
Out-of-bounds write in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96980
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96979
MEDIUM 6.8
Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96976
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96975
MEDIUM 5.9
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-96974
MEDIUM 6.8
Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96970
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96965
MEDIUM 5.3
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. |
|
CVE-2026-96179
MEDIUM 6.7
Use after free in DNS Server allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96156
MEDIUM 5.5
Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally. |
|
CVE-2026-96150
MEDIUM 5.6
Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-96144
MEDIUM 4.7
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-96137
MEDIUM 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information loc… |
|
CVE-2026-96133
MEDIUM 5.5
Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-96112
MEDIUM 5.5
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally. |
|
CVE-2026-96110
MEDIUM 5.5
Use after free in Windows OLE allows an authorized attacker to disclose information locally. |
|
CVE-2026-96101
MEDIUM 5.5
Files or directories accessible to external parties in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information l… |
|
CVE-2026-96093
MEDIUM 4.7
Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally. |
|
CVE-2026-96086
MEDIUM 6.5
Out-of-bounds read in Windows WLAN Service allows an unauthorized attacker to deny service over an adjacent network. |
|
CVE-2026-96082
MEDIUM 6.5
Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. |
|
CVE-2026-96059
MEDIUM 5.5
Use after free in HID class driver allows an authorized attacker to disclose information locally. |
|
CVE-2026-96058
MEDIUM 4.6
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack. |
|
CVE-2026-96048
MEDIUM 4.7
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-96041
MEDIUM 5.5
Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally. |
|
CVE-2026-96022
MEDIUM 5.6
Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally. |
|
CVE-2026-96018
MEDIUM 6.5
Weak authentication in Windows AppContainer allows an authorized attacker to disclose information locally. |
|
CVE-2026-96017
MEDIUM 4.9
Use after free in DNS Server allows an authorized attacker to deny service over a network. |
|
CVE-2026-96001
MEDIUM 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information l… |
|
CVE-2026-95998
MEDIUM 4.4
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to perform tampering locally. |
|
CVE-2026-95977
MEDIUM 5.5
Out-of-bounds read in Windows Event Viewer allows an authorized attacker to disclose information locally. |
|
CVE-2026-95946
MEDIUM 5.5
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-95944
MEDIUM 5.5
Weak authentication in Windows App Readiness Service allows an authorized attacker to perform tampering locally. |
|
CVE-2026-95913
MEDIUM 5.9
Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-95910
MEDIUM 6.7
Improper certificate validation in Windows Hyper-V allows an authorized attacker to bypass a security feature locally. |
|
CVE-2026-95908
MEDIUM 5.5
Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally. |
|
CVE-2026-95905
MEDIUM 6.8
Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-95893
MEDIUM 5.5
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
|
CVE-2026-95889
MEDIUM 6.6
Untrusted pointer dereference in Windows Storage allows an authorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-95884
MEDIUM 5.3
Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.