59.264 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.264 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-44230 | MED 6.5 | portswigger burp_suite PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows accoun | 1.0% | — |
| CVE-2020-1979 | HIGH 8.1 | paloaltonetworks pan-os A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and e | 1.0% | — |
| CVE-2019-13722 | MED 6.5 | google chrome Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 1.0% | — |
| CVE-2016-3135 | HIGH 7.8 | canonical ubuntu_linux Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsock | 1.0% | — |
| CVE-2004-1016 | LOW 2.1 | linux linux_kernel The scm_send function in the scm layer for Linux kernel 2.4.x up to 2.4.28, and 2.6.x up to 2.6.9, allows local users to cause a denial of service (system hang) via crafted auxiliary messages that are passed to the sendmsg function, which causes a deadlock con | 1.0% | — |
| CVE-2026-62910 | HIGH 7.2 | microsoft exchange_server Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | 1.0% | — |
| CVE-2025-64670 | MED 6.5 | microsoft windows_10_21h2 Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2023-24908 | HIGH 8.1 | microsoft windows_10_1507 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 1.0% | — |
| CVE-2023-24869 | HIGH 8.1 | microsoft windows_10_1507 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 1.0% | — |
| CVE-2023-23405 | HIGH 8.1 | microsoft windows_10_1507 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 1.0% | — |
| CVE-2022-43721 | MED 5.4 | apache superset An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and v | 1.0% | — |
| CVE-2022-20688 | MED 5.3 | cisco ata_190_firmware A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause Cisco Discovery Protocol service t | 1.0% | — |
| CVE-2022-20687 | MED 5.3 | cisco ata_190_firmware Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause the LLDP serv | 1.0% | — |
| CVE-2022-20686 | MED 5.3 | cisco ata_190_firmware Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device and cause the LLDP serv | 1.0% | — |
| CVE-2021-40488 | HIGH 7.8 | microsoft windows_10 Storage Spaces Controller Elevation of Privilege Vulnerability | 1.0% | — |
| CVE-2020-3568 | MED 5.8 | cisco asyncos A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to ins | 1.0% | — |
| CVE-2020-1381 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1382. | 1.0% | — |
| CVE-2020-0810 | HIGH 7.8 | microsoft visual_studio_2015 An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file creation in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system.An | 1.0% | — |
| CVE-2019-1317 | HIGH 7.3 | microsoft windows_10 A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'. | 1.0% | — |
| CVE-2019-1256 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1285. | 1.0% | — |
| CVE-2017-8566 | HIGH 7.0 | microsoft windows_10 Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor (IME) improperly handling parameters in a method of a DCOM class, aka "Windows IME Elevation of Privilege Vulnerability". | 1.0% | — |
| CVE-2016-1392 | HIGH 7.4 | cisco prime_collaboration_assurance Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuu34121. | 1.0% | — |
| CVE-2024-38573 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: cppc_cpufreq: Fix possible null pointer dereference cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from different places with various parameters. So cpufreq_cpu_get() | 1.0% | — |
| CVE-2023-41764 | MED 5.5 | microsoft 365_apps Microsoft Office Spoofing Vulnerability | 1.0% | — |
| CVE-2021-38974 | MED 6.5 | ibm security_guardium_key_lifecycle_manager IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially crafted HTTP requests. IBM X-Force ID: 212779. | 1.0% | — |