58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.507 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-38053 | HIGH 8.8 | microsoft windows_10_1507 Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability | 1.1% | — |
| CVE-2021-26866 | HIGH 7.1 | microsoft windows_10 Windows Update Service Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2020-26944 | CRIT 9.8 | aptean product_configurator An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the main login page (aka cse?cmd=LOGIN). This can be exploited directly, and remotely. | 1.1% | — |
| CVE-2018-1036 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows S | 1.1% | — |
| CVE-2018-0057 | MED 6.1 | juniper junos On MX Series and M120/M320 platforms configured in a Broadband Edge (BBE) environment, subscribers logging in with DHCP Option 50 to request a specific IP address will be assigned the requested IP address, even if there is a static MAC to IP address binding in | 1.1% | — |
| CVE-2017-6130 | HIGH 7.4 | f5 ssl_intercept_iapp F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed using the Dynamic Domain Bypass (DDB) feature feature plus SNAT Auto Map option for egress traffic. | 1.1% | — |
| CVE-2014-3793 | MED 5.8 | vmware esxi VMware Tools in VMware Workstation 10.x before 10.0.2, VMware Player 6.x before 6.0.2, VMware Fusion 6.x before 6.0.3, and VMware ESXi 5.0 through 5.5, when a Windows 8.1 guest OS is used, allows guest OS users to gain guest OS privileges or cause a denial of | 1.1% | — |
| CVE-2003-1423 | MED 5.0 | petitforum petitforum Petitforum stores the liste.txt data file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as e-mail addresses and encrypted passwords. | 1.1% | — |
| CVE-2026-5485 | HIGH 7.8 | amazon athena_odbc OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a | 1.1% | — |
| CVE-2024-30093 | HIGH 7.3 | microsoft windows_10_1507 Windows Storage Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2020-15941 | MED 5.4 | fortinet forticlient_endpoint_management_server A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory traversal character sequences to add/delete the files of the server via the name parameter of Deployment | 1.1% | — |
| CVE-2010-0924 | MED 5.0 | apple safari cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.3 and 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the BACKGROUND attribute of a BODY element. | 1.1% | — |
| CVE-2026-42530 | HIGH 8.1 | f5 nginx_gateway_fabric NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session | 1.1% | — |
| CVE-2025-21381 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 1.1% | — |
| CVE-2023-6792 | MED 5.5 | paloaltonetworks pan-os An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. | 1.1% | — |
| CVE-2022-31660 | HIGH 7.8 | vmware access_connector VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'. | 1.1% | — |
| CVE-2021-40767 | MED 5.5 | adobe character_animator Adobe Character Animator version 4.4 (and earlier) is affected by an Access of Memory Location After End of Buffer vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application deni | 1.1% | — |
| CVE-2020-1995 | MED 4.9 | paloaltonetworks pan-os A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by r | 1.1% | — |
| CVE-2018-20733 | HIGH 7.5 | sas web_infrastructure_platform BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE. | 1.1% | — |
| CVE-2024-49576 | HIGH 8.8 | foxit pdf_editor A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and resul | 1.1% | — |
| CVE-2023-6795 | MED 5.5 | paloaltonetworks pan-os An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. | 1.1% | — |
| CVE-2023-20164 | MED 6.5 | cisco identity_services_engine Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must ha | 1.1% | — |
| CVE-2023-20163 | MED 6.5 | cisco identity_services_engine Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must ha | 1.1% | — |
| CVE-2021-36963 | HIGH 7.8 | microsoft windows_10 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2019-19161 | HIGH 7.2 | cymiinstaller322_activex_project cymiinstaller322_activex CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability in downloading files by CyMiInstaller322 ActiveX caused by an attacker to download randomly generated DLL files and MIPLATFORM to load those DLLs due t | 1.1% | — |