58.702 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.702 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-31987 | HIGH 7.5 | apache airflow JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue. | 0.8% | — |
| CVE-2026-20223 | CRIT 10.0 | cisco secure_workload A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role. This vulnerability is due to insufficient | 0.8% | — |
| CVE-2024-22093 | HIGH 8.7 | f5 big-ip_access_policy_manager When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions | 0.8% | — |
| CVE-2022-20788 | MED 6.1 | cisco unified_communications_manager A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cr | 0.8% | — |
| CVE-2021-31182 | HIGH 7.1 | microsoft windows_10 Microsoft Bluetooth Driver Spoofing Vulnerability | 0.8% | — |
| CVE-2020-3982 | HIGH 7.7 | vmware cloud_foundation VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI de | 0.8% | — |
| CVE-2016-4569 | MED 5.5 | canonical ubuntu_linux The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface | 0.8% | — |
| CVE-2026-80352 | CRIT 9.8 | apache camel Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthoriz | 0.8% | — |
| CVE-2025-27522 | MED 6.5 | apache inlong Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry- | 0.8% | — |
| CVE-2024-53947 | CRIT 9.8 | apache superset Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This i | 0.8% | — |
| CVE-2024-0193 | HIGH 7.8 | linux linux_kernel A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or N | 0.8% | — |
| CVE-2023-36762 | HIGH 7.3 | microsoft 365_apps Microsoft Word Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2023-36704 | HIGH 7.8 | microsoft windows_10_1809 Windows Setup Files Cleanup Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2023-28256 | MED 6.6 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2023-28255 | MED 6.6 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2022-35847 | MED 6.3 | fortinet fortisoar An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote and authenticated attacker to execute arbitrary code via a cr | 0.8% | — |
| CVE-2022-35776 | MED 6.2 | microsoft azure_site_recovery_vmware_to_azure Azure Site Recovery Denial of Service Vulnerability | 0.8% | — |
| CVE-2022-21998 | MED 5.5 | microsoft windows_10 Windows Common Log File System Driver Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-43244 | MED 6.5 | microsoft windows_10 Windows Kernel Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-1257 | HIGH 8.8 | cisco catalyst_center A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to manipulate an authenticated user into executing malicious actions withou | 0.8% | — |
| CVE-2020-1605 | HIGH 8.8 | juniper junos When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may then arbitrarily execute comma | 0.8% | — |
| CVE-2017-5584 | MED 5.4 | paloaltonetworks pan-os Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified v | 0.8% | — |
| CVE-2025-47294 | MED 5.3 | fortinet fortios A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the csfd daemon via a specially crafted request. | 0.8% | — |
| CVE-2023-49657 | CRIT 9.6 | apache superset A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For | 0.8% | — |
| CVE-2023-37143 | MED 5.5 | microsoft chakracore ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp(). | 0.8% | — |