58.650 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.650 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-2075 | HIGH 7.5 | octopus octopus_server In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation. | 0.7% | — |
| CVE-2022-2049 | HIGH 7.5 | octopus octopus_server In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. | 0.7% | — |
| CVE-2022-0018 | MED 6.1 | paloaltonetworks globalprotect An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect p | 0.7% | — |
| CVE-2021-47515 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net | 0.7% | — |
| CVE-2021-46955 | HIGH 8.2 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 p | 0.7% | — |
| CVE-2020-3544 | HIGH 8.8 | cisco 8000p_ip_camera_firmware A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute arbitrary code on an affected device or cause the device to reload. This vulnerabili | 0.7% | — |
| CVE-2017-0523 | HIGH 7.0 | google android An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. | 0.7% | — |
| CVE-2016-1361 | MED 5.3 | cisco ios_xr Cisco IOS XR through 4.3.2 on Gigabit Switch Router (GSR) 12000 devices does not properly check for a Bidirectional Forwarding Detection (BFD) header in a UDP packet, which allows remote attackers to cause a denial of service (line-card restart) via a crafted | 0.7% | — |
| CVE-2026-86473 | CRIT 9.1 | apache airflow Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes no | 0.7% | — |
| CVE-2026-58319 | CRIT 9.1 | apache doris Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster inte | 0.7% | — |
| CVE-2026-56169 | HIGH 8.1 | microsoft windows_admin_center Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | 0.7% | — |
| CVE-2026-26135 | CRIT 9.6 | microsoft azure_custom_locations_resource_provider Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network. | 0.7% | — |
| CVE-2025-21361 | HIGH 7.8 | microsoft office Microsoft Outlook Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2025-21187 | HIGH 7.8 | microsoft power_automate_for_desktop Microsoft Power Automate Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2025-21179 | MED 4.8 | microsoft windows_11_24h2 DHCP Client Service Denial of Service Vulnerability | 0.7% | — |
| CVE-2024-43505 | HIGH 7.8 | microsoft 365_apps Microsoft Office Visio Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2024-36031 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem fo | 0.7% | — |
| CVE-2021-20432 | MED 6.5 | ibm spectrum_protect_plus IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Fo | 0.7% | — |
| CVE-2020-5740 | HIGH 7.8 | plex media_server Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. | 0.7% | — |
| CVE-2018-15372 | HIGH 8.1 | cisco ios_xe A vulnerability in the MACsec Key Agreement (MKA) using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic thr | 0.7% | — |
| CVE-2016-9774 | HIGH 7.8 | apache tomcat The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u8 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, | 0.7% | — |
| CVE-2015-2337 | MED 5.8 | vmware fusion TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, w | 0.7% | — |
| CVE-2015-2336 | MED 5.8 | vmware fusion TPView.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, | 0.7% | — |
| CVE-2026-64320 | CRIT 9.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64 | 0.7% | — |
| CVE-2024-49114 | HIGH 7.8 | microsoft windows_10_1809 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | 0.7% | — |