58.912 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.912 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-48828 | MED 6.5 | apache airflow The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON | 0.7% | — |
| CVE-2026-45192 | MED 6.5 | apache airflow A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the | 0.7% | — |
| CVE-2026-43826 | MED 6.5 | apache apache-airflow-providers-opensearch The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read | 0.7% | — |
| CVE-2026-41018 | MED 6.5 | apache apache-airflow-providers-elasticsearch The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log r | 0.7% | — |
| CVE-2026-21529 | MED 5.7 | microsoft azure_hdinsight Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network. | 0.7% | — |
| CVE-2025-32720 | MED 5.5 | microsoft windows_10_1507 Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. | 0.7% | — |
| CVE-2025-26521 | HIGH 8.1 | apache cloudstack When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the p | 0.7% | — |
| CVE-2024-50276 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free of TX skb The scope of the TX skb is wider than just mse102x_tx_frame_spi(), so in case the TX skb room needs to be expanded, we should free | 0.7% | — |
| CVE-2024-38173 | MED 6.7 | microsoft 365_apps Microsoft Outlook Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2024-30394 | HIGH 7.5 | juniper junos A Stack-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) component of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an rpd crash, leading to Denial of Service (DoS). On all Junos OS and Junos | 0.7% | — |
| CVE-2024-29049 | MED 4.1 | microsoft edge_chromium Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability | 0.7% | — |
| CVE-2022-4187 | MED 6.5 | google chrome Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium) | 0.7% | — |
| CVE-2022-21900 | MED 4.6 | microsoft windows_10 Windows Hyper-V Security Feature Bypass Vulnerability | 0.7% | — |
| CVE-2021-42956 | HIGH 7.8 | zoho manageengine_remote_access_plus_server Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admi | 0.7% | — |
| CVE-2021-26603 | HIGH 8.6 | bandisoft ark_library A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the Ark_DigPathA function parsed a file path. This vulnerability is due to missing support for string length check. | 0.7% | — |
| CVE-2020-3116 | MED 5.5 | cisco webex_meetings_online A vulnerability in the way Cisco Webex applications process Universal Communications Format (UCF) files could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient validation of UCF media files. An attacker co | 0.7% | — |
| CVE-2017-7339 | MED 6.1 | fortinet fortiportal A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the 'Name' and 'Description' inputs in the 'Add Revision Backup' functionality. | 0.7% | — |
| CVE-2016-1273 | MED 5.9 | juniper junos Juniper Junos OS before 13.2X51-D40, 14.x before 14.1X53-D30, and 15.x before 15.1X53-D20 on QFX5100 and QFX10002 switches do not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic encryption and authentication protecti | 0.7% | — |
| CVE-2026-72954 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-72943 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-72928 | HIGH 7.5 | microsoft windows_server_2025 Use after free in Windows DNS allows an authorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-69852 | HIGH 7.5 | microsoft windows_10_1607 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 0.7% | — |
| CVE-2026-69599 | HIGH 7.5 | microsoft windows_11_23h2 Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-69539 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | 0.7% | — |
| CVE-2026-69514 | HIGH 7.5 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | 0.7% | — |