59.356 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.356 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-22097 | MED 6.5 | vmware spring_advanced_message_queuing_protocol In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util | 1.1% | — |
| CVE-2020-3583 | MED 6.1 | cisco adaptive_security_appliance_software Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a | 1.1% | — |
| CVE-2016-1156 | MED 5.7 | linecorp line LINE 4.3.0.724 and earlier on Windows and 4.3.1 and earlier on OS X allows remote authenticated users to cause a denial of service (application crash) via a crafted post that is mishandled when displaying a Timeline. | 1.1% | — |
| CVE-2025-30399 | HIGH 7.5 | microsoft .net Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. | 1.1% | — |
| CVE-2020-11580 | CRIT 9.1 | pulsesecure pulse_connect_secure An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate. | 1.1% | — |
| CVE-2016-2078 | MED 6.1 | vmware vcenter_server Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter. | 1.1% | — |
| CVE-2013-5565 | MED 4.3 | cisco ios_xr The OSPFv3 functionality in Cisco IOS XR 5.1 allows remote attackers to cause a denial of service (process crash) via a malformed LSA Type-1 packet, aka Bug ID CSCuj82176. | 1.1% | — |
| CVE-2012-0333 | MED 5.0 | cisco small_business_ip_phone Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768. | 1.1% | — |
| CVE-2025-31104 | HIGH 7.2 | fortinet fortiadc A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7.4.0 through 7.4.6, FortiADC 7.2.0 through 7.2.7, FortiADC 7.1.0 through 7.1.4, FortiADC 7.0 all vers | 1.1% | — |
| CVE-2024-23349 | MED 5.4 | apache answer Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. XSS attack when user enters summary. A logged-in user, when modifying their own submitted ques | 1.1% | — |
| CVE-2023-24487 | MED 6.3 | citrix application_delivery_controller Arbitrary file read in Citrix ADC and Citrix Gateway | 1.1% | — |
| CVE-2023-20220 | HIGH 7.2 | cisco secure_firewall_management_center Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. To exploit these vulnerabilities, | 1.1% | — |
| CVE-2022-26071 | HIGH 7.4 | f5 big-ip_access_policy_manager On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a flaw in the way reply ICMP packets are limited in the Traffic Manage | 1.1% | — |
| CVE-2021-43237 | HIGH 7.8 | microsoft windows_10 Windows Setup Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2021-3055 | MED 6.5 | paloaltonetworks pan-os An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the fi | 1.1% | — |
| CVE-2019-1901 | HIGH 8.8 | cisco nx-os A vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an adjacent, unauthenticated attacker to cause a denial of service (DoS) condition or exe | 1.1% | — |
| CVE-2019-16029 | CRIT 9.1 | cisco smart_software_manager_on-prem A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service | 1.1% | — |
| CVE-2014-6031 | MED 4.9 | f5 big-ip_access_policy_manager Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, 11.5.x before 11.5.2 HF1, and 11.6.0 before HF4, and Enterprise Manager 2.1.0 through 2.3.0 and 3.x before 3.1.1 HF5 all | 1.1% | — |
| CVE-2009-2454 | MED 4.3 | citrix web_interface Cross-site scripting (XSS) vulnerability in Citrix Web Interface 4.6, 5.0, and 5.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 1.1% | — |
| CVE-2009-1965 | MED 5.4 | oracle database_server Unspecified vulnerability in the Net Foundation Layer component in Oracle Database 9.2.0.8 and 10.1.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. | 1.1% | — |
| CVE-2025-32710 | HIGH 8.1 | microsoft windows_server_2008 Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. | 1.1% | — |
| CVE-2021-35240 | MED 6.5 | solarwinds orion_platform A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. | 1.1% | — |
| CVE-2021-1725 | MED 5.5 | microsoft bot_framework_software_development_kit Bot Framework SDK Information Disclosure Vulnerability | 1.1% | — |
| CVE-2020-3546 | MED 5.3 | cisco asyncos A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insuffic | 1.1% | — |
| CVE-2017-8040 | MED 6.5 | vmware single_sign-on_for_pivotal_cloud_foundry In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed X | 1.1% | — |