Vulnerabilities
Tracked app vulnerabilities
6,355 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,355
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-83926
MEDIUM 4.4
Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally. |
|
CVE-2026-83925
MEDIUM 4.7
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-83909
MEDIUM 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informat… |
|
CVE-2026-83907
MEDIUM 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally. |
|
CVE-2026-83906
MEDIUM 6.5
Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2026-83905
MEDIUM 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally. |
|
CVE-2026-83904
MEDIUM 5.5
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-83898
MEDIUM 5.5
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-83897
MEDIUM 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informat… |
|
CVE-2026-83895
MEDIUM 6.8
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-83893
MEDIUM 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose informat… |
|
CVE-2026-83892
MEDIUM 5.5
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-83888
MEDIUM 6.5
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network. |
|
CVE-2026-83887
MEDIUM 5.5
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-83885
MEDIUM 5.6
Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally. |
|
CVE-2026-83884
MEDIUM 5.5
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-83875
MEDIUM 5.5
Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-83870
MEDIUM 5.5
Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally. |
|
CVE-2026-83865
MEDIUM 4.7
Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. |
|
CVE-2026-83864
MEDIUM 5.5
Improper access control in Windows NTFS allows an authorized attacker to disclose information locally. |
|
CVE-2026-83854
MEDIUM 5.5
Improper access control in Windows Notification allows an authorized attacker to disclose information locally. |
|
CVE-2026-83849
MEDIUM 5.5
Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally. |
|
CVE-2026-83835
MEDIUM 5.5
Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally. |
|
CVE-2026-83798
MEDIUM 5.5
Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally. |
|
CVE-2026-83794
MEDIUM 5.5
Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized attacker to disclose information locally. |
|
CVE-2026-83788
MEDIUM 4.6
Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack. |
|
CVE-2026-83787
MEDIUM 5.5
Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. |
|
CVE-2026-83786
MEDIUM 4.7
Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally. |
|
CVE-2026-83776
MEDIUM 6.8
Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-83774
MEDIUM 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informat… |
|
CVE-2026-83773
MEDIUM 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information… |
|
CVE-2026-83766
MEDIUM 4.2
Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network. |
|
CVE-2026-83765
MEDIUM 5.5
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-83764
MEDIUM 5.5
Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally. |
|
CVE-2026-83760
MEDIUM 5.5
Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker to disclose information locally. |
|
CVE-2026-83755
MEDIUM 5.5
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
|
CVE-2026-83747
MEDIUM 5.5
Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information locally. |
|
CVE-2026-83737
MEDIUM 5.5
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
|
CVE-2026-83736
MEDIUM 5.5
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-83733
MEDIUM 5.5
Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. |
|
CVE-2026-83723
MEDIUM 5.5
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
|
CVE-2026-83719
MEDIUM 5.5
Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally. |
|
CVE-2026-83714
MEDIUM 5.5
Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally. |
|
CVE-2026-83713
MEDIUM 5.5
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. |
|
CVE-2026-83706
MEDIUM 6.7
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-83705
MEDIUM 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally. |
|
CVE-2026-83703
MEDIUM 6.5
Out-of-bounds read in Windows Wi-Fi Driver allows an unauthorized attacker to deny service over an adjacent network. |
|
CVE-2026-83697
MEDIUM 4.7
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
|
CVE-2026-83695
MEDIUM 5.5
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
|
CVE-2026-83686
MEDIUM 5.5
Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.