59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-47963 | MED 6.3 | microsoft edge_chromium No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-37947 | HIGH 8.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data leng | 0.6% | — |
| CVE-2025-23250 | HIGH 7.6 | nvidia nemo NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directory by an arbitrary file write. A successful exploit of this vulnerability might lead to code execution and data tampering. | 0.6% | — |
| CVE-2024-25141 | CRIT 9.1 | apache apache-airflow-providers-mongo When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue. | 0.6% | — |
| CVE-2024-21585 | MED 5.9 | juniper junos An Improper Handling of Exceptional Conditions vulnerability in BGP session processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker, using specific timing outside the attacker's control, to flap BGP sessio | 0.6% | — |
| CVE-2023-36711 | HIGH 7.8 | microsoft windows_10_1507 Windows Runtime C++ Template Library Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2023-36634 | HIGH 7.1 | fortinet fortiap-u An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbi | 0.6% | — |
| CVE-2023-33161 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2023-33158 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2023-33149 | HIGH 7.8 | microsoft 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2023-32552 | MED 5.3 | trendmicro apex_one An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32553 | 0.6% | — |
| CVE-2023-22408 | HIGH 7.5 | juniper junos An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an attacker sends an SIP packets with a malformed SDP f | 0.6% | — |
| CVE-2022-24454 | HIGH 7.8 | microsoft windows_10 Windows Security Support Provider Interface Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-23290 | HIGH 7.8 | microsoft windows_10 Windows Inking COM Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-22215 | MED 6.5 | juniper junos A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module (PAM) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Ser | 0.6% | — |
| CVE-2021-25195 | HIGH 7.8 | microsoft windows_10 Windows PKU2U Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-24103 | HIGH 7.8 | microsoft windows_10 Windows Event Tracing Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2020-6647 | MED 5.4 | fortinet fortiadc_firmware An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter. | 0.6% | — |
| CVE-2018-0197 | MED 6.5 | cisco ios A vulnerability in the VLAN Trunking Protocol (VTP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to corrupt the internal VTP database on an affected device and cause a denial of service (DoS) condi | 0.6% | — |
| CVE-2015-0679 | MED 6.1 | cisco wireless_lan_controller_software The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via a malformed password, aka Bug ID CSCui57980. | 0.6% | — |
| CVE-2013-7446 | MED 5.3 | linux linux_kernel Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls. | 0.6% | — |
| CVE-2026-88204 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2024-50283 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It will avoid freeing session before calling smb3_preauth_hash_ | 0.6% | — |
| CVE-2023-6791 | MED 4.9 | paloaltonetworks pan-os A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web in | 0.6% | — |
| CVE-2023-41085 | HIGH 7.5 | f5 big-ip_access_policy_manager When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.6% | — |