59.049 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.049 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-3319 | LOW 3.3 | cisco webex_network_recording_player A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnera | 0.7% | — |
| CVE-2010-1437 | HIGH 7.0 | debian debian_linux Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl | 0.7% | — |
| CVE-2002-2426 | MED 4.3 | citrix access_essentials Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs | 0.7% | — |
| CVE-2026-55814 | HIGH 7.5 | apache ranger Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | 0.7% | — |
| CVE-2026-32690 | LOW 3.7 | apache airflow Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not a | 0.7% | — |
| CVE-2026-28814 | HIGH 7.5 | apache jspwiki Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue. | 0.7% | — |
| CVE-2025-62458 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | 0.7% | — |
| CVE-2025-54911 | HIGH 7.3 | microsoft windows_10_1507 Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. | 0.7% | — |
| CVE-2024-39534 | MED 5.4 | juniper junos_os_evolved An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the | 0.7% | — |
| CVE-2024-38084 | HIGH 7.8 | microsoft officeplus Microsoft OfficePlus Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2024-37985 | MED 5.9 | microsoft windows_11_22h2 Windows Kernel Information Disclosure Vulnerability | 0.7% | — |
| CVE-2024-36913 | CRIT 9.3 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that a | 0.7% | — |
| CVE-2024-23668 | HIGH 8.8 | fortinet fortiwebmanager An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CL | 0.7% | — |
| CVE-2023-38163 | HIGH 7.8 | microsoft windows_defender_security_intelligence_updates Windows Defender Attack Surface Reduction Security Feature Bypass | 0.7% | — |
| CVE-2023-32020 | MED 5.6 | microsoft windows_server_2008 Windows DNS Spoofing Vulnerability | 0.7% | — |
| CVE-2023-23390 | HIGH 7.8 | microsoft 3d_builder 3D Builder Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2023-23378 | HIGH 7.8 | microsoft print_3d Print 3D Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2022-26120 | MED 5.4 | fortinet fortiadc Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or | 0.7% | — |
| CVE-2021-1698 | HIGH 7.8 | microsoft windows_10 Windows Win32k Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2019-15270 | MED 5.4 | cisco firepower_management_center_firmware A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerabil | 0.7% | — |
| CVE-2012-1326 | HIGH 7.4 | cisco ironport_web_security_appliance Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks | 0.7% | — |
| CVE-2026-50485 | MED 4.5 | microsoft windows_10_1607 Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network. | 0.7% | — |
| CVE-2026-42588 | HIGH 8.1 | apache activemq Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console | 0.7% | — |
| CVE-2026-35194 | HIGH 8.1 | apache flink Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affec | 0.7% | — |
| CVE-2026-24640 | MED 6.6 | fortinet fortiweb A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0.2 through 7.0.12 may allow a remote authenticated att | 0.7% | — |