Vulnerabilities
Tracked app vulnerabilities
18,157 CVEs affect a tracked app or OS (High, all platforms). 296 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,157
- Actively exploited
- 296
- Publication window
- 2004-07-27 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-97013
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-97002
HIGH 7.5
Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-97000
HIGH 7.0
Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96994
HIGH 7.0
Use after free in Winsock allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96978
HIGH 7.0
Use after free in Windows Credential User Interface allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96973
HIGH 7.0
Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96972
HIGH 7.5
Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. |
|
CVE-2026-96971
HIGH 7.0
Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96969
HIGH 7.0
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96845
HIGH 7.8
Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96184
HIGH 7.8
Heap-based buffer overflow in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96176
HIGH 7.5
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-96175
HIGH 7.8
Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96174
HIGH 7.8
Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96172
HIGH 7.8
No cwe for this issue in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96171
HIGH 7.0
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96168
HIGH 7.0
Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96162
HIGH 7.8
Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96160
HIGH 7.8
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96158
HIGH 7.0
Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96155
HIGH 7.0
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96153
HIGH 7.0
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96152
HIGH 7.8
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96139
HIGH 7.0
Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96134
HIGH 7.5
Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-96129
HIGH 7.8
Inclusion of functionality from untrusted control sphere in Windows Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96127
HIGH 7.8
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96126
HIGH 7.8
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96124
HIGH 7.0
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96122
HIGH 7.8
Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96117
HIGH 7.8
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96115
HIGH 8.0
Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. |
|
CVE-2026-96107
HIGH 7.0
Null pointer dereference in Windows Phone Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96103
HIGH 7.8
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96102
HIGH 7.8
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96097
HIGH 7.0
Release of invalid pointer or reference in Windows Brokering File System allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96088
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an autho… |
|
CVE-2026-96085
HIGH 7.8
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96084
HIGH 7.8
Heap-based buffer overflow in Graphic Fonts allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96077
HIGH 7.5
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-96076
HIGH 7.8
Use after free in Windows DIAL Client allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96075
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate pr… |
|
CVE-2026-96074
HIGH 7.8
Heap-based buffer overflow in Windows AppX Package Manager allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96073
HIGH 7.0
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96072
HIGH 7.0
Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96066
HIGH 7.8
Stack-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96062
HIGH 7.8
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96061
HIGH 7.0
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96060
HIGH 7.8
Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-96057
HIGH 7.8
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.