59.251 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.251 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-26618 | HIGH 7.1 | tmax tooffice An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code. | 1.0% | — |
| CVE-2017-12228 | MED 5.9 | cisco ios A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The v | 1.0% | — |
| CVE-2015-7997 | MED 4.3 | citrix netscaler_application_delivery_controller_firmware Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delive | 1.0% | — |
| CVE-2013-1245 | MED 4.0 | cisco webex_social The user-management page in Cisco WebEx Social relies on client-side validation of values in the Screen Name, First Name, Middle Name, Last Name, Email Address, and Job Title fields, which allows remote authenticated users to bypass intended access restriction | 1.0% | — |
| CVE-2026-97749 | CRIT 9.8 | microsoft 365_apps Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-97016 | CRIT 9.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2026-88156 | CRIT 9.8 | microsoft 365_apps Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 1.0% | — |
| CVE-2024-38211 | HIGH 8.2 | microsoft dynamics_365 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | 1.0% | — |
| CVE-2021-23005 | CRIT 9.1 | f5 big-iq_centralized_management On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached | 1.0% | — |
| CVE-2020-1975 | MED 6.8 | paloaltonetworks pan-os Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 an | 1.0% | — |
| CVE-2020-17001 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 1.0% | — |
| CVE-2020-1661 | MED 5.3 | juniper junos On Juniper Networks Junos OS devices configured as a DHCP forwarder, the Juniper Networks Dynamic Host Configuration Protocol Daemon (jdhcp) process might crash when receiving a malformed DHCP packet. This issue only affects devices configured as DHCP forwarde | 1.0% | — |
| CVE-2019-6678 | MED 5.3 | f5 big-ip_access_policy_manager On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, the TMM process may restart when the packet filter feature is enabled. | 1.0% | — |
| CVE-2019-16156 | MED 6.1 | fortinet fortiweb An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthenticated attacker to perform a Cross Site Scripting attack (XSS). | 1.0% | — |
| CVE-2019-12415 | MED 5.5 | apache poi In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External En | 1.0% | — |
| CVE-2018-8599 | HIGH 7.8 | microsoft visual_studio An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations, aka "Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability." This affects Microsoft Vi | 1.0% | — |
| CVE-2016-6034 | MED 6.8 | ibm tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of privileges. | 1.0% | — |
| CVE-2014-3394 | MED 5.0 | cisco adaptive_security_appliance_software The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an | 1.0% | — |
| CVE-2026-48579 | CRIT 9.1 | microsoft exchange_online Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-32211 | CRIT 9.1 | microsoft azure_web_apps Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2025-67895 | CRIT 9.8 | apache apache-airflow-providers-edge3 Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially relea | 1.0% | — |
| CVE-2025-37899 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the | 1.0% | — |
| CVE-2023-33135 | HIGH 7.3 | microsoft .net .NET and Visual Studio Elevation of Privilege Vulnerability | 1.0% | — |
| CVE-2023-33128 | HIGH 7.3 | microsoft .net .NET and Visual Studio Remote Code Execution Vulnerability | 1.0% | — |
| CVE-2023-33126 | HIGH 7.3 | microsoft .net .NET and Visual Studio Remote Code Execution Vulnerability | 1.0% | — |