58.848 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.848 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-12347 | MED 6.1 | cisco data_center_network_manager Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client inter | 0.9% | — |
| CVE-2017-12346 | MED 6.1 | cisco data_center_network_manager Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client inter | 0.9% | — |
| CVE-2016-6365 | MED 6.1 | cisco secure_firewall_management_center Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518. | 0.9% | — |
| CVE-2016-4930 | MED 6.1 | juniper junos_space Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions. | 0.9% | — |
| CVE-2016-1323 | MED 4.3 | cisco spark The REST interface in Cisco Spark 2015-06 allows remote authenticated users to obtain sensitive information via a request for an unspecified file, aka Bug ID CSCuv84048. | 0.9% | — |
| CVE-2025-29847 | HIGH 7.5 | apache linkis A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the | 0.9% | — |
| CVE-2022-42720 | HIGH 7.8 | debian debian_linux Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code. | 0.9% | — |
| CVE-2022-26803 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2022-26798 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2021-41015 | MED 6.1 | fortinet fortiweb A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler | 0.9% | — |
| CVE-2020-16998 | HIGH 7.0 | microsoft windows_10 DirectX Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2020-12815 | MED 5.4 | fortinet fortianalyzer An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via IPv4/IPv6 address fields. | 0.9% | — |
| CVE-2026-63317 | MED 5.6 | apache opennlp Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.f | 0.9% | — |
| CVE-2023-36030 | MED 6.1 | microsoft dynamics_365 Microsoft Dynamics 365 Sales Spoofing Vulnerability | 0.9% | — |
| CVE-2023-30867 | MED 4.9 | apache streampark In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName fie | 0.9% | — |
| CVE-2021-43211 | MED 5.5 | microsoft windows_10_update_assistant Windows 10 Update Assistant Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2021-34462 | HIGH 7.0 | microsoft windows_10 Windows AppX Deployment Extensions Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2021-22113 | MED 5.3 | vmware spring_cloud_netflix_zuul Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spri | 0.9% | — |
| CVE-2021-20486 | MED 6.5 | ibm cloud_pak_for_data IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668. | 0.9% | — |
| CVE-2020-27727 | MED 4.9 | f5 big-ip_access_policy_manager On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user rea | 0.9% | — |
| CVE-2019-18654 | MED 6.1 | avg anti-virus A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. | 0.9% | — |
| CVE-2019-18653 | MED 6.1 | avast antivirus A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. | 0.9% | — |
| CVE-2011-1898 | HIGH 7.4 | citrix xen Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection r | 0.9% | — |
| CVE-2009-3043 | MED 4.9 | linux linux_kernel The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a denial of service (system crash, sometimes preceded by a NULL pointer dereference) or possibly gain privileges via certain p | 0.9% | — |
| CVE-2023-31036 | HIGH 7.5 | nvidia triton_inference_server NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful | 0.9% | — |