Vulnerabilities
Tracked app vulnerabilities
18,765 CVEs affect a tracked app or OS (all severities, Windows). 304 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,765
- Actively exploited
- 304
- Publication window
- 2004-07-27 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-97015
MEDIUM 6.8
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
|
CVE-2026-97013
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-97006
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-97002
HIGH 7.5
Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-97000
HIGH 7.0
Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96994
HIGH 7.0
Use after free in Winsock allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96992
MEDIUM 6.4
Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96989
MEDIUM 5.5
Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally. |
|
CVE-2026-96988
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96987
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96986
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96985
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96984
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96983
MEDIUM 5.3
Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network. |
|
CVE-2026-96982
MEDIUM 6.8
Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96981
MEDIUM 6.4
Out-of-bounds write in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96980
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96979
MEDIUM 6.8
Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96978
HIGH 7.0
Use after free in Windows Credential User Interface allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96976
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96975
MEDIUM 5.9
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-96974
MEDIUM 6.8
Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-96973
HIGH 7.0
Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96972
HIGH 7.5
Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. |
|
CVE-2026-96971
HIGH 7.0
Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96970
MEDIUM 4.9
Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
|
CVE-2026-96969
HIGH 7.0
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96965
MEDIUM 5.3
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. |
|
CVE-2026-96845
HIGH 7.8
Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96184
HIGH 7.8
Heap-based buffer overflow in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96179
MEDIUM 6.7
Use after free in DNS Server allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96176
HIGH 7.5
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-96175
HIGH 7.8
Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96174
HIGH 7.8
Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96172
HIGH 7.8
No cwe for this issue in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96171
HIGH 7.0
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96168
HIGH 7.0
Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96162
HIGH 7.8
Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96160
HIGH 7.8
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96158
HIGH 7.0
Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96157
CRITICAL 9.8
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-96156
MEDIUM 5.5
Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally. |
|
CVE-2026-96155
HIGH 7.0
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96153
HIGH 7.0
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96152
HIGH 7.8
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96150
MEDIUM 5.6
Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-96144
MEDIUM 4.7
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-96139
HIGH 7.0
Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96137
MEDIUM 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information loc… |
|
CVE-2026-96134
HIGH 7.5
Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.