58.650 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.650 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-1353 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1249, CVE-2020-1370, CVE-2020-1399, CVE-2020-1404, CVE | 0.7% | — |
| CVE-2020-1085 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Service handles objects in memory, aka 'Windows Function Discovery Service Elevation of Privilege Vulnerability'. | 0.7% | — |
| CVE-2019-11487 | HIGH 7.8 | canonical ubuntu_linux The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kern | 0.7% | — |
| CVE-2018-0165 | HIGH 7.4 | cisco ios_xe A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust buffers on an affected device, resulting in a denial of service (DoS) conditi | 0.7% | — |
| CVE-2017-12275 | HIGH 7.4 | cisco wireless_lan_controller_software A vulnerability in the implementation of 802.11v Basic Service Set (BSS) Transition Management functionality in Cisco Wireless LAN Controllers could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a | 0.7% | — |
| CVE-2015-0735 | MED 6.8 | cisco unified_customer_voice_portal Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970. | 0.7% | — |
| CVE-2013-3472 | MED 6.8 | cisco unified_communications_manager Cross-site request forgery (CSRF) vulnerability in the Enterprise License Manager (ELM) in Cisco Unified Communications Manager (CM) allows remote attackers to hijack the authentication of arbitrary users for requests that make ELM modifications, aka Bug ID CS | 0.7% | — |
| CVE-2026-53362 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are co | 0.7% | |
| CVE-2025-54906 | HIGH 7.8 | microsoft 365_apps Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2025-48822 | HIGH 8.6 | microsoft windows_10_1607 Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2024-38079 | HIGH 7.8 | microsoft windows_10_1507 Windows Graphics Component Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2024-38070 | HIGH 7.8 | microsoft windows_10_1507 Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability | 0.7% | — |
| CVE-2024-20321 | HIGH 8.6 | cisco nx-os A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because eBGP | 0.7% | — |
| CVE-2023-39228 | MED 5.3 | intel unison_software Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. | 0.7% | — |
| CVE-2023-28772 | MED 6.7 | linux linux_kernel An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. | 0.7% | — |
| CVE-2022-45888 | MED 6.4 | linux linux_kernel An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device. | 0.7% | — |
| CVE-2022-22031 | HIGH 7.8 | microsoft windows_10 Windows Credential Guard Domain-joined Public Key Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2018-6664 | MED 5.8 | mcafee data_loss_prevention_endpoint Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility. | 0.7% | — |
| CVE-2026-42535 | CRIT 9.1 | apache http_server A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes t | 0.7% | — |
| CVE-2026-22153 | HIGH 8.1 | fortinet fortios An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is confi | 0.7% | — |
| CVE-2025-64663 | CRIT 9.9 | microsoft azure_language Custom Question Answering Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2025-30412 | CRIT 10.0 | acronis cyber_protect Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800. | 0.7% | — |
| CVE-2025-23316 | CRIT 9.8 | nvidia triton_inference_server NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote code execution by manipulating the model name parameter in the model control APIs. A successful exploit of this vulnerab | 0.7% | — |
| CVE-2024-41178 | HIGH 7.5 | apache arrow Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRol | 0.7% | — |
| CVE-2024-30382 | HIGH 7.5 | juniper junos An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to m | 0.7% | — |