58.848 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.848 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-3642 | MED 5.9 | citrix netscaler_application_delivery_controller The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3 Build 68.5, 10.0 through Build 78.6, 10.1 before Build 130.13, 10.1.e before Build 130.1302.e, 10.5 b | 0.8% | — |
| CVE-2005-0750 | HIGH 7.2 | conectiva linux The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value. | 0.8% | — |
| CVE-2026-8855 | HIGH 8.1 | ibm http_server IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication). | 0.8% | — |
| CVE-2024-45791 | HIGH 7.5 | apache hertzbeat Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue. | 0.8% | — |
| CVE-2023-5257 | LOW 3.5 | whitehsbg jndiexploit A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. | 0.8% | — |
| CVE-2023-40720 | HIGH 7.1 | fortinet fortivoice An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to read the SIP configuration of other users via crafted HTTP or HTTPS requests. | 0.8% | — |
| CVE-2023-24923 | MED 5.5 | microsoft onedrive Microsoft OneDrive for Android Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-22060 | MED 4.3 | oracle communications_cloud_native_core_console In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against addi | 0.8% | — |
| CVE-2021-0218 | HIGH 7.8 | juniper junos A command injection vulnerability in the license-check daemon of Juniper Networks Junos OS that may allow a locally authenticated attacker with low privileges to execute commands with root privilege. license-check is a daemon used to manage licenses in Junos O | 0.8% | — |
| CVE-2020-26086 | MED 4.3 | cisco telepresence_collaboration_endpoint A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storag | 0.8% | — |
| CVE-2018-0471 | HIGH 7.4 | cisco ios_xe A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6.1 and 16.6.2 could allow an unauthenticated, adjacent attacker to cause a memory leak that may lead to a denial of service (DoS) condition. The vulnerability is | 0.8% | — |
| CVE-2012-4115 | MED 5.8 | cisco unified_computing_system The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM virtual-media data, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify this traffic by inserting packets into | 0.8% | — |
| CVE-2012-4114 | MED 5.8 | cisco unified_computing_system The fabric-interconnect KVM module in Cisco Unified Computing System (UCS) does not encrypt video data, which allows man-in-the-middle attackers to watch KVM display content by sniffing the network or modify this traffic by inserting packets into the client-se | 0.8% | — |
| CVE-2011-1439 | MED 6.8 | google chrome Google Chrome before 11.0.696.57 on Linux does not properly isolate renderer processes, which has unspecified impact and remote attack vectors. | 0.8% | — |
| CVE-2026-70563 | HIGH 8.1 | microsoft windows_10_1607 Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | 0.8% | — |
| CVE-2025-22254 | MED 6.6 | fortinet fortios An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6. | 0.8% | — |
| CVE-2024-38105 | MED 6.5 | microsoft windows_10_1507 Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability | 0.8% | — |
| CVE-2024-38102 | MED 6.5 | microsoft windows_10_1507 Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability | 0.8% | — |
| CVE-2024-38101 | MED 6.5 | microsoft windows_10_1507 Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability | 0.8% | — |
| CVE-2024-21384 | HIGH 7.8 | microsoft 365_apps Microsoft Office OneNote Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2023-5717 | HIGH 7.8 | linux linux_kernel A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si | 0.8% | — |
| CVE-2022-41052 | HIGH 7.8 | microsoft windows_10 Windows Graphics Component Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2022-22480 | HIGH 7.5 | ibm qradar_security_information_and_event_manager IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure. IBM X-Force ID: 225889. | 0.8% | — |
| CVE-2022-2074 | HIGH 7.5 | octopus octopus_server In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. | 0.8% | — |
| CVE-2022-0972 | HIGH 8.8 | google chrome Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. | 0.8% | — |