58.535 CVE tracked
797 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.535 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-6666 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream server or cache sends the BIG-IP an invalid age header value. | 1.0% | — |
| CVE-2019-6661 | HIGH 7.5 | f5 big-ip_access_policy_manager When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources. | 1.0% | — |
| CVE-2019-6660 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service. | 1.0% | — |
| CVE-2019-20831 | HIGH 7.5 | foxitsoftware 3d An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. It has void data mishandling, causing a crash. | 1.0% | — |
| CVE-2013-1202 | HIGH 7.5 | cisco ace_application_control_engine_module_a2 Cisco ACE A2(3.6) allows log retention DoS. | 1.0% | — |
| CVE-2026-73240 | CRIT 9.8 | apache allura Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. | 1.0% | — |
| CVE-2026-43951 | MED 6.5 | apache http_server Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. | 1.0% | — |
| CVE-2026-33523 | MED 6.5 | apache http_server HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue. | 1.0% | — |
| CVE-2025-21352 | MED 6.5 | microsoft windows_10_1507 Internet Connection Sharing (ICS) Denial of Service Vulnerability | 1.0% | — |
| CVE-2025-21254 | MED 6.5 | microsoft windows_10_1607 Internet Connection Sharing (ICS) Denial of Service Vulnerability | 1.0% | — |
| CVE-2024-43477 | HIGH 7.5 | microsoft entra_id Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant. | 1.0% | — |
| CVE-2023-44156 | HIGH 7.5 | acronis cyber_protect Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979. | 1.0% | — |
| CVE-2020-0798 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system p | 1.0% | — |
| CVE-2019-0942 | MED 5.5 | microsoft windows_10 An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it improperly restricts access to the registry, aka 'Unified Write Filter Elevation of Privilege Vulnerability'. | 1.0% | — |
| CVE-2013-6940 | MED 5.0 | citrix netscaler_application_delivery_controller_firmware Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 logs user credentials, which allows attackers to obtain sensitive information via unspecified vectors. | 1.0% | — |
| CVE-2005-3170 | MED 5.0 | microsoft windows_2000 The LDAP client on Microsoft Windows 2000 before Update Rollup 1 for SP4 accepts certificates using LDAP Secure Sockets Layer (LDAPS) even when the Certificate Authority (CA) is not trusted, which could allow attackers to trick users into believing that they a | 1.0% | — |
| CVE-2025-49657 | HIGH 8.8 | microsoft windows_server_2008 Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2024-49088 | HIGH 7.8 | microsoft windows_10_1507 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 1.0% | — |
| CVE-2024-23111 | MED 6.8 | fortinet fortios An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reb | 1.0% | — |
| CVE-2023-36727 | MED 6.1 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 1.0% | — |
| CVE-2022-22433 | HIGH 7.5 | ibm robotic_process_automation IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS | 1.0% | — |
| CVE-2021-26108 | HIGH 7.5 | fortinet fortios A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering. | 1.0% | — |
| CVE-2021-1396 | CRIT 9.8 | cisco application_policy_infrastructure_controller Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration ch | 1.0% | — |
| CVE-2020-3139 | MED 5.3 | cisco application_policy_infrastructure_controller A vulnerability in the out of band (OOB) management interface IP table rule programming for Cisco Application Policy Infrastructure Controller (APIC) could allow an unauthenticated, remote attacker to bypass configured deny entries for specific IP ports. These | 1.0% | — |
| CVE-2019-1981 | MED 5.8 | cisco firepower_services_software_for_asa A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protect | 1.0% | — |