56.831 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.831 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2007-3890 | HIGH 9.3 | microsoft excel Microsoft Excel in Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a Workspace with a certain index value that triggers memory corruption. | 28.9% | — |
| CVE-2009-3130 | HIGH 9.3 | microsoft compatibility_pack_word_excel_powerpoint Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a spreadsheet containing a malformed Binary File Format (aka BIFF) rec | 28.9% | — |
| CVE-2011-1995 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized, aka "OLEAuto32.dll Remote Code Execution Vulnerability." | 28.9% | — |
| CVE-2010-3346 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML | 28.9% | — |
| CVE-2010-3345 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Element Me | 28.9% | — |
| CVE-2010-3343 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Object Mem | 28.9% | — |
| CVE-2008-4024 | HIGH 9.3 | microsoft office Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers | 28.9% | — |
| CVE-2010-0034 | HIGH 9.3 | microsoft powerpoint Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "Office PowerPoint Viewer TextCharsAtom Record Stack Overflow Vulnerability." | 28.8% | — |
| CVE-2014-6340 | MED 4.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability." | 28.8% | — |
| CVE-2008-0533 | MED 4.3 | cisco acs_for_windows Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web scrip | 28.8% | — |
| CVE-2023-34991 | CRIT 9.8 | fortinet fortiwlm A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized co | 28.8% | — |
| CVE-2010-0252 | HIGH 9.3 | microsoft windows_2000 The Microsoft Data Analyzer ActiveX control (aka the Office Excel ActiveX control for Data Analysis) in max3activex.dll in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, | 28.8% | — |
| CVE-2018-4936 | MED 6.5 | adobe flash_player Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitation could lead to information disclosure. | 28.7% | — |
| CVE-2009-1529 | HIGH 8.1 | microsoft internet_explorer Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by calling the setCap | 28.7% | — |
| CVE-1999-0739 | MED 5.0 | microsoft internet_information_server The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. | 28.7% | — |
| CVE-1999-0738 | MED 5.0 | microsoft internet_information_server The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. | 28.7% | — |
| CVE-2007-3826 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 7 on Windows XP SP2 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via repeated document.open function calls after a user requests a new page, but before t | 28.7% | — |
| CVE-2007-1201 | HIGH 9.3 | microsoft biztalk_server Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to DataSource that trigger memory corruption, aka "Office Web Components DataSource Vul | 28.7% | — |
| CVE-2006-2386 | MED 6.8 | microsoft outlook_express Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file. | 28.7% | — |
| CVE-2005-1211 | MED 5.1 | microsoft internet_explorer Buffer overflow in the PNG image rendering component of Microsoft Internet Explorer allows remote attackers to execute arbitrary code via a crafted PNG file. | 28.7% | — |
| CVE-2010-0817 | MED 4.3 | microsoft sharepoint_server Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 | 28.7% | — |
| CVE-2013-1315 | HIGH 9.3 | microsoft excel Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitr | 28.7% | — |
| CVE-2015-2515 | HIGH 9.3 | microsoft windows_10 Use-after-free vulnerability in Windows Shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute | 28.7% | — |
| CVE-2016-0150 | HIGH 7.5 | microsoft windows_10 HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability." | 28.6% | — |
| CVE-2006-1540 | HIGH 9.3 | microsoft office MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed | 28.6% | — |