58.553 CVE tracked
797 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.553 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-31685 | CRIT 9.8 | vmware workspace_one_assist VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application. | 1.0% | — |
| CVE-2020-11583 | MED 6.1 | plesk obsidian A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. | 1.0% | — |
| CVE-2019-6604 | MED 6.8 | f5 big-ip_access_policy_manager On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems with a High-Speed Bridge and using non-default Layer 2 forwarding configurations may experience a lockup of the High-Speed | 1.0% | — |
| CVE-2019-6594 | MED 5.9 | f5 big-ip_access_policy_manager On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances. | 1.0% | — |
| CVE-2017-0626 | MED 5.5 | linux linux_kernel An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without expli | 1.0% | — |
| CVE-2017-0624 | MED 5.5 | linux linux_kernel An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user | 1.0% | — |
| CVE-2014-9870 | HIGH 7.8 | google android The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly consider user-space access to the TPIDRURW register, which allows local users to gain privileges via a crafted application, a | 1.0% | — |
| CVE-2012-3375 | MED 4.9 | linux linux_kernel The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted | 1.0% | — |
| CVE-2025-22225 | HIGH 8.2 | ransomware vmware cloud_foundation VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. | 1.0% | |
| CVE-2025-21383 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Information Disclosure Vulnerability | 1.0% | — |
| CVE-2023-0394 | MED 5.5 | linux linux_kernel A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. | 1.0% | — |
| CVE-2019-1041 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, | 1.0% | — |
| CVE-2018-20245 | HIGH 7.5 | apache airflow The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking. | 1.0% | — |
| CVE-2017-3815 | MED 5.3 | cisco telepresence_server_software An API Privilege vulnerability in Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to emulate Cisco TelePresence Server endpoints. Affected Products: This vulnerability affects Cisco TelePresence Server MSE 8710 Processors tha | 1.0% | — |
| CVE-2012-3063 | HIGH 7.1 | cisco application_control_engine_software Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access | 1.0% | — |
| CVE-2006-1863 | LOW 2.1 | linux linux_kernel Directory traversal vulnerability in CIFS in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1864. | 1.0% | — |
| CVE-2022-20962 | LOW 3.8 | cisco identity_services_engine A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This vulnerability is due to insufficient input | 1.0% | — |
| CVE-2021-40125 | MED 5.3 | cisco adaptive_security_appliance_software A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to trigger a denial of service (Do | 1.0% | — |
| CVE-2021-1478 | MED 5.3 | cisco hosted_collaboration_mediation_fulfillment A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to cause a | 1.0% | — |
| CVE-2018-0402 | HIGH 8.8 | cisco unified_contact_center_express Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. Cisco Bug IDs: CSCvg70921. | 1.0% | — |
| CVE-2018-0388 | MED 4.8 | cisco wireless_lan_controller_software A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulne | 1.0% | — |
| CVE-2018-0214 | MED 5.3 | cisco identity_services_engine A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection. These commands | 1.0% | — |
| CVE-2014-2568 | LOW 2.9 | canonical ubuntu_linux Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. | 1.0% | — |
| CVE-2012-3094 | MED 5.0 | cisco anyconnect_secure_mobility_client The VPN downloader in the download_install component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information | 1.0% | — |
| CVE-2025-58726 | HIGH 7.5 | microsoft windows_10_1507 Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network. | 1.0% | — |