59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-7469 | MED 5.4 | f5 big-ip_access_policy_manager A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11. | 0.9% | — |
| CVE-2016-1275 | MED 6.5 | juniper junos Juniper Junos OS before 13.3R9, 14.1R6 before 14.1R6-S1, and 14.1 before 14.1R7, when configured with VPLS routing-instances, allows remote attackers to obtain sensitive mbuf information by injecting a flood of Ethernet frames with IPv6 MAC addresses directly | 0.9% | — |
| CVE-2014-3400 | MED 4.0 | cisco webex_meetings_server Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344. | 0.9% | — |
| CVE-2014-2185 | MED 4.0 | cisco unified_communications_manager The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374. | 0.9% | — |
| CVE-2014-2138 | MED 4.3 | cisco security_manager CRLF injection vulnerability in the web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCun82349. | 0.9% | — |
| CVE-2014-2137 | MED 4.3 | cisco web_security_appliance CRLF injection vulnerability in the web framework in Cisco Web Security Appliance (WSA) 7.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct redirection attacks via a crafted URL, aka Bug ID CSCuj61002. | 0.9% | — |
| CVE-2013-6695 | MED 4.0 | cisco secure_access_control_system The RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining re | 0.9% | — |
| CVE-2013-6687 | MED 4.0 | cisco webex_meetings_server The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876. | 0.9% | — |
| CVE-2013-3442 | MED 4.0 | cisco unified_communications_manager The web portal in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive stack-trace information via unspecified vectors that trigger a stack exception, aka Bug ID CSCug34854. | 0.9% | — |
| CVE-2013-3428 | MED 4.0 | cisco secure_access_control_system The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive information via an unspecified request that triggers an error, aka Bug ID CSCue65957. | 0.9% | — |
| CVE-2013-1107 | MED 4.0 | cisco webex_social The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235. | 0.9% | — |
| CVE-2012-6325 | MED 4.0 | vmware vcenter_server_appliance VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 does not properly parse XML documents, which allows remote authenticated users to read arbitrary files via unspecified vectors. | 0.9% | — |
| CVE-2011-0714 | MED 5.7 | linux linux_kernel Use-after-free vulnerability in a certain Red Hat patch for the RPC server sockets functionality in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 might allow remote attackers to cause a denial of service (crash) via malformed data in a packet, r | 0.9% | — |
| CVE-2026-104712 | HIGH 7.5 | apache struts Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce | 0.9% | — |
| CVE-2024-20659 | HIGH 7.1 | microsoft windows_10_1809 Windows Hyper-V Security Feature Bypass Vulnerability | 0.9% | — |
| CVE-2023-46715 | MED 5.0 | fortinet fortios An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send (but not receive) packets spoofing the IP of ano | 0.9% | — |
| CVE-2022-38010 | HIGH 7.8 | microsoft 365_apps Microsoft Office Visio Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2022-24479 | HIGH 7.8 | microsoft windows_10 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2021-34510 | HIGH 7.8 | microsoft windows_10 Windows Storage Spaces Controller Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2020-17014 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 0.9% | — |
| CVE-2020-1527 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Custom Protocol Engine improperly handles memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted | 0.9% | — |
| CVE-2009-0754 | LOW 2.1 | php php PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other | 0.9% | — |
| CVE-2026-70266 | HIGH 8.8 | microsoft sharepoint_server Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 0.9% | — |
| CVE-2025-53720 | HIGH 8.0 | microsoft windows_server_2008 Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2025-49739 | HIGH 8.8 | microsoft visual_studio Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network. | 0.9% | — |