Skip to content
Appaloosa Scout
Language selector
fr en

Vulnerabilities

Tracked app vulnerabilities

18,849 CVEs affect a tracked app or OS (all severities, Windows). 305 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs
18,849
Actively exploited
305
Publication window
2004-07-27 → 2026-11-11

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

18,849 entries Windows Hide N/A Clear all
CVE
CVE-2026-40401
HIGH 7.1

Windows TCP/IP Denial of Service Vulnerability

CVE-2026-40399
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg…

CVE-2026-40398
HIGH 7.8

Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

CVE-2026-40397
HIGH 7.8

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-40382
HIGH 7.8

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

CVE-2026-40380
MEDIUM 6.2

Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.

CVE-2026-40377
HIGH 7.8

Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

CVE-2026-40369
HIGH 7.8

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-40367
HIGH 8.4

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-40366
HIGH 8.4

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-40364
HIGH 8.4

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-40363
HIGH 8.4

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-40362
HIGH 7.8

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-40361
HIGH 8.4

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-40360
HIGH 7.8

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-40359
HIGH 7.8

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-40358
HIGH 8.4

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-35440
MEDIUM 5.5

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-35436
HIGH 8.8

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVE-2026-35424
HIGH 7.5

Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a netwo…

CVE-2026-35423
MEDIUM 5.4

Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-35422
MEDIUM 6.5

Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.

CVE-2026-35421
HIGH 7.8

Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.

CVE-2026-35420
HIGH 7.8

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-35419
MEDIUM 5.5

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.

CVE-2026-35418
HIGH 7.8

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-35417
HIGH 7.8

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVE-2026-35416
HIGH 7.0

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile…

CVE-2026-35415
HIGH 7.8

Integer overflow or wraparound in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

CVE-2026-34351
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg…

CVE-2026-34350
MEDIUM 6.5

Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network.

CVE-2026-34347
HIGH 7.0

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVE-2026-34345
HIGH 7.0

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile…

CVE-2026-34344
HIGH 7.8

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile…

CVE-2026-34343
HIGH 7.8

Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally.

CVE-2026-34342
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker t…

CVE-2026-34341
HIGH 7.0

Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.

CVE-2026-34340
HIGH 7.0

Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2026-34339
MEDIUM 5.5

Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally.

CVE-2026-34338
HIGH 7.8

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

CVE-2026-34337
HIGH 7.8

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-34336
HIGH 7.8

Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CVE-2026-34334
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg…

CVE-2026-34333
HIGH 7.8

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CVE-2026-34332
HIGH 8.0

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.

CVE-2026-34331
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p…

CVE-2026-34330
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p…

CVE-2026-34329
HIGH 8.8

Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-33841
HIGH 7.8

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-33840
HIGH 7.8

Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM