Actively exploited vulnerabilities (CISA KEV)

HIGH 8.8

2026-09-09

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag…

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Windows Update Stack Elevation of Privilege Vulnerability

HIGH 8.8

2026-09-03

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C…

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

HIGH 8.8

2026-06-09

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted …

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

HIGH 8.6

2026-04-11

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype…

HIGH 8.8

2026-04-01

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi…

HIGH 8.8

2026-03-13

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H…

HIGH 8.8

2026-03-13

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (…

HIGH 8.8

2026-02-13

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch…

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Windows Remote Access Connection Manager Denial of Service Vulnerability

Desktop Window Manager Elevation of Privilege Vulnerability

MSHTML Framework Security Feature Bypass Vulnerability

Windows Shell Security Feature Bypass Vulnerability

HIGH 7.8

2026-01-26

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

HIGH 8.8

macOS iOS

2025-12-12

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a cra…

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

HIGH 8.8

2025-11-17

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi…

Windows Kernel Elevation of Privilege Vulnerability

Host Process for Windows Tasks Elevation of Privilege Vulnerability

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11

Windows Agere Modem Driver Elevation of Privilege Vulnerability

CRITICAL 9.8

2025-09-24

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi…

HIGH 8.8

WinRAR

2025-08-08

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This…

HIGH 8.8

iOS macOS

2025-07-15

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox…

HIGH 8.1

2025-06-30

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur…

HIGH 7.8

WinRAR

2025-06-21

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected install…

Windows SMB Client Elevation of Privilege Vulnerability

Internet Shortcut Files Remote Code Execution Vulnerability

HIGH 8.8

2025-06-03

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML …

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Scripting Engine Memory Corruption Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

HIGH 8.3

2025-03-26

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb…

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Windows NTFS Information Disclosure Vulnerability

Windows Fast FAT File System Driver Remote Code Execution Vulnerability

Windows NTFS Information Disclosure Vulnerability