60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
Actively exploited vulnerabilities
809 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-2425 | HIGH 8.8 | microsoft internet_explorer Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and | 44.7% | |
| CVE-2013-3900 | MED 5.5 | microsoft windows_10_1507 Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windo | 44.6% | |
| CVE-2026-20131 | CRIT 10.0 | ransomware cisco secure_firewall_management_center A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to i | 44.4% | |
| CVE-2019-1579 | HIGH 8.1 | ransomware paloaltonetworks pan-os Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code. | 44.2% | |
| CVE-2026-32201 | MED 6.5 | microsoft sharepoint_server Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 43.4% | |
| CVE-2016-3235 | HIGH 7.8 | microsoft visio Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vuln | 43.3% | |
| CVE-2007-0671 | HIGH 8.8 | microsoft access Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero | 43.2% | |
| CVE-2021-42292 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Security Feature Bypass Vulnerability | 43.0% | |
| CVE-2009-0238 | HIGH 8.8 | microsoft excel Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attacker | 42.9% | |
| CVE-2023-36874 | HIGH 7.8 | microsoft windows_10_1507 Windows Error Reporting Service Elevation of Privilege Vulnerability | 42.6% | |
| CVE-2020-0787 | HIGH 7.8 | ransomware microsoft windows_10_1507 An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'. | 42.5% | |
| CVE-2026-0300 | CRIT 9.8 | paloaltonetworks pan-os A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls | 41.7% | |
| CVE-2025-20352 | HIGH 7.7 | cisco ios A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following: An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on | 41.5% | |
| CVE-2019-0841 | HIGH 7.8 | ransomware microsoft windows_10_1703 An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-08 | 41.4% | |
| CVE-2024-38178 | HIGH 7.5 | microsoft windows_10_1507 Scripting Engine Memory Corruption Vulnerability | 41.4% | |
| CVE-2023-4762 | HIGH 8.8 | debian debian_linux Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | 41.4% | |
| CVE-2023-29336 | HIGH 7.8 | microsoft windows_10_1507 Win32k Elevation of Privilege Vulnerability | 41.2% | |
| CVE-2022-21999 | HIGH 7.8 | ransomware microsoft windows_10_1507 Windows Print Spooler Elevation of Privilege Vulnerability | 41.0% | |
| CVE-2017-5030 | HIGH 8.8 | debian debian_linux Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page. | 40.6% | |
| CVE-2015-0666 | HIGH 7.5 | cisco prime_data_center_network_manager Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241. | 40.4% | |
| CVE-2015-2424 | HIGH 8.8 | microsoft excel_viewer Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Off | 40.1% | |
| CVE-2021-34448 | MED 6.8 | microsoft windows_10_1507 Scripting Engine Memory Corruption Vulnerability | 40.1% | |
| CVE-2014-0496 | HIGH 8.8 | adobe acrobat Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. | 40.0% | |
| CVE-2013-6282 | HIGH 8.8 | linux linux_kernel The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted applica | 39.7% | |
| CVE-2021-1647 | HIGH 7.8 | microsoft security_essentials Microsoft Defender Remote Code Execution Vulnerability | 39.7% |