58.650 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.650 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-21363 | HIGH 7.8 | microsoft 365_apps Microsoft Word Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2024-28902 | MED 5.5 | microsoft windows_10_1507 Windows Remote Access Connection Manager Information Disclosure Vulnerability | 0.8% | — |
| CVE-2024-26255 | MED 5.5 | microsoft windows_10_1809 Windows Remote Access Connection Manager Information Disclosure Vulnerability | 0.8% | — |
| CVE-2024-26207 | MED 5.5 | microsoft windows_10_1507 Windows Remote Access Connection Manager Information Disclosure Vulnerability | 0.8% | — |
| CVE-2024-20444 | MED 5.5 | cisco nexus_dashboard_fabric_controller A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device. | 0.8% | — |
| CVE-2023-44154 | HIGH 8.1 | acronis cyber_protect Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979. | 0.8% | — |
| CVE-2023-36398 | MED 6.5 | microsoft windows_10_1507 Windows NTFS Information Disclosure Vulnerability | 0.8% | — |
| CVE-2020-17137 | HIGH 7.8 | microsoft windows_10 DirectX Graphics Kernel Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2018-9568 | HIGH 7.8 | canonical ubuntu_linux In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Version | 0.8% | — |
| CVE-2008-0732 | LOW 2.1 | apache geronimo The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories. | 0.8% | — |
| CVE-2026-81377 | MED 6.5 | microsoft visual_studio_code Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | 0.8% | — |
| CVE-2026-69806 | HIGH 7.0 | microsoft .net Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. | 0.8% | — |
| CVE-2026-69356 | CRIT 9.3 | microsoft exchange_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 0.8% | — |
| CVE-2026-62801 | MED 6.5 | microsoft windows_10_1607 Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. | 0.8% | — |
| CVE-2026-47287 | MED 6.5 | microsoft visual_studio_code Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | 0.8% | — |
| CVE-2026-46745 | MED 5.3 | apache apache-airflow-providers-fab Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade i | 0.8% | — |
| CVE-2026-41090 | CRIT 9.3 | microsoft 365_copilot Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. | 0.8% | — |
| CVE-2026-30912 | HIGH 7.5 | apache airflow In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, wh | 0.8% | — |
| CVE-2026-28779 | HIGH 7.5 | apache airflow Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tok | 0.8% | — |
| CVE-2026-20934 | HIGH 7.5 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-20848 | HIGH 7.5 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2025-24039 | HIGH 7.3 | microsoft visual_studio_code Visual Studio Code Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2024-38119 | HIGH 7.5 | microsoft windows_10_1507 Windows Network Address Translation (NAT) Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2024-38057 | HIGH 7.8 | microsoft windows_10_1507 Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2024-38034 | HIGH 7.8 | microsoft windows_10_1507 Windows Filtering Platform Elevation of Privilege Vulnerability | 0.8% | — |