Skip to content
Appaloosa Scout
Language selector
fr en

Vulnerabilities

Tracked app vulnerabilities

19,673 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs
19,673
Actively exploited
303
Publication window
1997-01-01 → 2026-10-20

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

19,673 entries Windows Clear all
CVE
CVE-2026-32158
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev…

CVE-2026-32157
HIGH 8.8

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-32156
HIGH 7.4

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally.

CVE-2026-32155
HIGH 7.8

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-32154
HIGH 7.8

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-32153
HIGH 7.8

Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

CVE-2026-32152
HIGH 7.8

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-32151
MEDIUM 6.5

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.

CVE-2026-32150
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta…

CVE-2026-32149
HIGH 7.3

Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.

CVE-2026-32093
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta…

CVE-2026-32091
HIGH 8.4

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker …

CVE-2026-32090
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authorized attacker to ele…

CVE-2026-32089
HIGH 7.8

Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally.

CVE-2026-32088
MEDIUM 6.1

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to byp…

CVE-2026-32087
HIGH 7.0

Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

CVE-2026-32086
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta…

CVE-2026-32085
MEDIUM 5.5

Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose information locally.

CVE-2026-32084
MEDIUM 5.5

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-32083
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate pr…

CVE-2026-32082
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate pr…

CVE-2026-32081
MEDIUM 5.5

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-32079
MEDIUM 5.5

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-32078
HIGH 7.8

Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2026-32077
HIGH 7.8

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

CVE-2026-32076
HIGH 7.8

Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

CVE-2026-32075
HIGH 7.0

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

CVE-2026-32074
HIGH 7.8

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2026-32073
HIGH 7.0

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-32072
MEDIUM 6.2

Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.

CVE-2026-32071
HIGH 7.5

Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

CVE-2026-32070
HIGH 7.0

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-32069
HIGH 7.8

Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2026-32068
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate pr…

CVE-2026-27931
MEDIUM 5.5

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

CVE-2026-27930
MEDIUM 5.5

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.

CVE-2026-27929
HIGH 7.0

Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally.

CVE-2026-27927
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to e…

CVE-2026-27926
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized atta…

CVE-2026-27925
MEDIUM 6.5

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to disclose information over an adjacent network.

CVE-2026-27924
HIGH 7.8

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-27923
HIGH 7.8

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-27922
HIGH 7.0

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-27921
HIGH 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg…

CVE-2026-27920
HIGH 7.8

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

CVE-2026-27919
HIGH 7.8

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

CVE-2026-27918
HIGH 7.8

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege…

CVE-2026-27917
HIGH 7.0

Use after free in Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) allows an authorized attacker to elevate privileges locally.

CVE-2026-27916
HIGH 7.8

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

CVE-2026-27915
HIGH 7.8

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM