58.650 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.650 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-41871 | CRIT 9.8 | apache nutch Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to | 0.7% | — |
| CVE-2026-20129 | CRIT 9.8 | cisco catalyst_sd-wan_manager A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authenticatio | 0.7% | — |
| CVE-2025-32713 | HIGH 7.8 | microsoft windows_10_1507 Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 0.7% | — |
| CVE-2024-43456 | MED 4.8 | microsoft windows_server_2008 Windows Remote Desktop Services Tampering Vulnerability | 0.7% | — |
| CVE-2024-26800 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decrypti | 0.7% | — |
| CVE-2024-20375 | HIGH 8.6 | cisco unified_communications_manager A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to cause a denial of s | 0.7% | — |
| CVE-2023-20055 | HIGH 8.0 | cisco catalyst_center A vulnerability in the management API of Cisco DNA Center could allow an authenticated, remote attacker to elevate privileges in the context of the web-based management interface on an affected device. This vulnerability is due to the unintended exposure of se | 0.7% | — |
| CVE-2022-34479 | MED 6.5 | mozilla firefox A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Thunderbird for Linux. Other operating systems are | 0.7% | — |
| CVE-2022-22460 | HIGH 7.5 | ibm security_verify_governance IBM Security Verify Identity Manager 10.0 contains sensitive information in the source code repository that could be used in further attacks against the system. IBM X-Force ID: 225013. | 0.7% | — |
| CVE-2021-1467 | MED 4.3 | cisco webex_meetings A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafte | 0.7% | — |
| CVE-2017-3873 | HIGH 7.5 | cisco aironet_access_point_firmware A vulnerability in the Plug-and-Play (PnP) subsystem of the Cisco Aironet 1800, 2800, and 3800 Series Access Points running a Lightweight Access Point (AP) or Mobility Express image could allow an unauthenticated, adjacent attacker to execute arbitrary code wi | 0.7% | — |
| CVE-2014-3812 | MED 5.0 | juniper fips_infranet_controller_6500 The Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS before 7.4r5 and 8.x before 8.0r1 and Junos Pulse Access Control Service (UAC) before 4.4r5 and 5.x before 5.0r1 enable cipher suites with weak encryption algorithms, which make it eas | 0.7% | — |
| CVE-2005-3807 | MED 4.9 | linux linux_kernel Memory leak in the VFS file lease handling in locks.c in Linux kernels 2.6.10 to 2.6.15 allows local users to cause a denial of service (memory exhaustion) via certain Samba activities that cause an fasync entry to be re-allocated by the fcntl_setlease functio | 0.7% | — |
| CVE-2026-7755 | HIGH 8.8 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files. | 0.7% | — |
| CVE-2026-66756 | CRIT 9.8 | apache tika Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue. | 0.7% | — |
| CVE-2026-53405 | CRIT 9.8 | apache syncope Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTa | 0.7% | — |
| CVE-2026-44631 | CRIT 9.8 | apache http_server Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue. | 0.7% | — |
| CVE-2025-23195 | HIGH 7.5 | apache ambari An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` class without disabling e | 0.7% | — |
| CVE-2024-52054 | LOW 2.7 | wowza streaming_engine Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system. | 0.7% | — |
| CVE-2024-48903 | HIGH 7.8 | trendmicro deep_security_agent An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target | 0.7% | — |
| CVE-2024-36052 | HIGH 7.5 | rarlab winrar RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899. | 0.7% | — |
| CVE-2023-33835 | MED 4.3 | ibm security_verify_information_queue IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 256015. | 0.7% | — |
| CVE-2023-31131 | HIGH 7.4 | vmware greenplum_database Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file wri | 0.7% | — |
| CVE-2023-21718 | HIGH 7.8 | microsoft sql_server Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2022-44694 | HIGH 7.8 | microsoft 365_apps Microsoft Office Visio Remote Code Execution Vulnerability | 0.7% | — |