59.123 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.123 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-32588 | MED 6.5 | apache cassandra Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue. | 0.7% | — |
| CVE-2026-25700 | HIGH 7.2 | apache answer Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactiva | 0.7% | — |
| CVE-2026-23985 | MED 6.5 | apache superset A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse l | 0.7% | — |
| CVE-2025-59328 | MED 6.5 | apache fory A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an ex | 0.7% | — |
| CVE-2025-47169 | HIGH 7.8 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2025-20139 | HIGH 7.5 | cisco enterprise_chat_and_email A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input to chat | 0.7% | — |
| CVE-2024-56736 | MED 6.5 | apache hertzbeat Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue. | 0.7% | — |
| CVE-2024-38210 | HIGH 7.8 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2024-38209 | HIGH 7.8 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2024-27254 | MED 5.3 | ibm db2 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 federated server is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 283813. | 0.7% | — |
| CVE-2023-4273 | MED 6.0 | debian debian_linux A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging t | 0.7% | — |
| CVE-2023-36860 | HIGH 7.1 | intel unison_software Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. | 0.7% | — |
| CVE-2022-48829 | CRIT 9.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger t | 0.7% | — |
| CVE-2022-41083 | HIGH 7.8 | microsoft jupyter Visual Studio Code Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2022-37999 | HIGH 7.8 | microsoft windows_10 Windows Group Policy Preference Client Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2022-37994 | HIGH 7.8 | microsoft windows_10 Windows Group Policy Preference Client Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2022-37993 | HIGH 7.8 | microsoft windows_10 Windows Group Policy Preference Client Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2022-30305 | LOW 3.7 | fortinet fortideceptor An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 | 0.7% | — |
| CVE-2022-24484 | MED 5.5 | microsoft windows_server_2012 Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability | 0.7% | — |
| CVE-2022-23268 | MED 6.5 | microsoft windows_11 Windows Hyper-V Denial of Service Vulnerability | 0.7% | — |
| CVE-2021-38896 | MED 6.1 | ibm qradar_advisor IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted | 0.7% | — |
| CVE-2021-29712 | MED 6.1 | ibm infosphere_information_server IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust | 0.7% | — |
| CVE-2020-3953 | MED 4.8 | vmware vrealize_log_insight Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation. | 0.7% | — |
| CVE-2019-6593 | MED 5.9 | f5 big-ip_access_policy_manager On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in | 0.7% | — |
| CVE-2018-15801 | HIGH 7.4 | vmware spring_framework Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a ma | 0.7% | — |