59.289 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.289 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2018-18966 | MED 4.9 | oscommerce online_merchant osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file. | 1.0% | — |
| CVE-2017-0626 | MED 5.5 | linux linux_kernel An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without expli | 1.0% | — |
| CVE-2017-0624 | MED 5.5 | linux linux_kernel An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user | 1.0% | — |
| CVE-2014-9870 | HIGH 7.8 | google android The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly consider user-space access to the TPIDRURW register, which allows local users to gain privileges via a crafted application, a | 1.0% | — |
| CVE-2012-3375 | MED 4.9 | linux linux_kernel The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted | 1.0% | — |
| CVE-2026-23655 | MED 6.5 | microsoft confidential_sidecar_containers Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2023-42505 | MED 4.3 | apache superset An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0. | 1.0% | — |
| CVE-2023-30991 | HIGH 7.5 | ibm db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 254037. | 1.0% | — |
| CVE-2022-28670 | HIGH 7.8 | foxit pdf_editor This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicio | 1.0% | — |
| CVE-2013-2852 | MED 6.9 | canonical ubuntu_linux Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format strin | 1.0% | — |
| CVE-2025-59248 | HIGH 7.5 | microsoft exchange_server Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 1.0% | — |
| CVE-2025-33054 | HIGH 8.1 | microsoft windows_11_22h2 Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network. | 1.0% | — |
| CVE-2025-21331 | HIGH 7.3 | microsoft windows_10_1507 Windows Installer Elevation of Privilege Vulnerability | 1.0% | — |
| CVE-2024-37968 | HIGH 7.5 | microsoft windows_server_2008 Windows DNS Spoofing Vulnerability | 1.0% | — |
| CVE-2023-27523 | MED 5.0 | apache superset Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to. | 1.0% | — |
| CVE-2022-24908 | HIGH 7.8 | foxit pdf_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 1.0% | — |
| CVE-2022-24907 | HIGH 7.8 | foxit pdf_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 1.0% | — |
| CVE-2021-0232 | HIGH 7.4 | fedoraproject fedora An authentication bypass vulnerability in the Juniper Networks Paragon Active Assurance Control Center may allow an attacker with specific information about the deployment to mimic an already registered Test Agent and access its configuration including associa | 1.0% | — |
| CVE-2020-5894 | HIGH 8.1 | f5 nginx_controller On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. | 1.0% | — |
| CVE-2020-3502 | MED 4.1 | cisco webex_meetings Multiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted information from other Webex users. These vulnerabilities are due to improper input validation of parameters r | 1.0% | — |
| CVE-2020-3501 | MED 4.1 | cisco webex_meetings Multiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted information from other Webex users. These vulnerabilities are due to improper input validation of parameters r | 1.0% | — |
| CVE-2020-3377 | MED 6.3 | cisco data_center_network_manager A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the affected device. The vulnerability is due to insufficient validation of user-supplie | 1.0% | — |
| CVE-2020-1418 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Diagnostics Execution Service fails to properly sanitize input, leading to an unsecure library-loading behavior, aka 'Windows Diagnostics Hub Elevation of Privilege Vulnerability'. This CVE ID is | 1.0% | — |
| CVE-2020-11492 | HIGH 7.8 | docker docker_desktop An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and | 1.0% | — |
| CVE-2020-1029 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE | 1.0% | — |