58.849 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.849 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-35270 | MED 5.3 | microsoft windows_10_1507 Windows iSCSI Service Denial of Service Vulnerability | 0.9% | — |
| CVE-2023-20046 | HIGH 8.8 | cisco staros A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied credentials | 0.9% | — |
| CVE-2023-20020 | HIGH 8.6 | cisco broadworks_application_delivery_platform_device_management A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an aff | 0.9% | — |
| CVE-2021-23013 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) | 0.9% | — |
| CVE-2018-10879 | MED 4.2 | canonical ubuntu_linux A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. | 0.9% | — |
| CVE-2017-5051 | HIGH 8.8 | google chrome An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer. | 0.9% | — |
| CVE-2016-1393 | HIGH 7.1 | cisco cloud_network_automation_provisioner SQL injection vulnerability in Cisco Cloud Network Automation Provisioner (CNAP) 1.0 and 1.1 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuy72175. | 0.9% | — |
| CVE-2006-5701 | MED 4.9 | linux linux_kernel Double free vulnerability in squashfs module in the Linux kernel 2.6.x, as used in Fedora Core 5 and possibly other distributions, allows local users to cause a denial of service by mounting a crafted squashfs filesystem. | 0.9% | — |
| CVE-2026-69641 | CRIT 9.1 | microsoft exchange_server Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-66309 | CRIT 9.1 | microsoft azure_sql_database Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-24306 | CRIT 9.8 | microsoft azure_front_door Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2025-27742 | MED 5.5 | microsoft windows_10_1507 Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally. | 0.9% | — |
| CVE-2024-30323 | HIGH 7.8 | foxit pdf_editor Foxit PDF Reader template Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in | 0.9% | — |
| CVE-2020-7860 | HIGH 7.8 | unegg_project unegg UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by UnEGG. Attackers could exploit this and arbitrary code execution. This issue affects: Estsoft UnEGG 0.5 version | 0.9% | — |
| CVE-2018-15426 | MED 4.8 | cisco unity_connection A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is du | 0.9% | — |
| CVE-2018-0047 | HIGH 8.0 | juniper junos_space A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user | 0.9% | — |
| CVE-2017-15703 | MED 5.0 | apache nifi Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on | 0.9% | — |
| CVE-2017-0336 | MED 5.5 | linux linux_kernel An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user per | 0.9% | — |
| CVE-2017-0334 | MED 5.5 | linux linux_kernel An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user per | 0.9% | — |
| CVE-2026-78463 | HIGH 8.8 | microsoft remote_desktop_client Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-70332 | CRIT 9.6 | microsoft sharepoint_online Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 0.9% | — |
| CVE-2026-69320 | HIGH 8.8 | microsoft visual_studio_code Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2026-57104 | HIGH 8.8 | microsoft azure_storage_explorer Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2026-55008 | CRIT 9.6 | microsoft exchange_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 0.9% | — |
| CVE-2026-49179 | HIGH 8.8 | microsoft windows_10_1607 Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network. | 0.9% | — |