59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.223 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-21068 | MED 6.1 | adobe creative_cloud_desktop_application Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction. | 0.6% | — |
| CVE-2019-3016 | MED 6.2 | linux linux_kernel In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later | 0.6% | — |
| CVE-2019-19231 | HIGH 7.3 | broadcom ca_client_automation An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attacker to gain escalated privileges. | 0.6% | — |
| CVE-2019-1235 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or commands it receives, aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'. | 0.6% | — |
| CVE-2026-65948 | HIGH 7.3 | apache ranger UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | 0.6% | — |
| CVE-2025-60714 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-21692 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <[email protected]> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The o | 0.6% | — |
| CVE-2025-21275 | HIGH 7.8 | microsoft windows_10_21h2 Windows App Package Installer Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-56640 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making | 0.6% | — |
| CVE-2024-43571 | MED 5.6 | microsoft windows_11_24h2 Sudo for Windows Spoofing Vulnerability | 0.6% | — |
| CVE-2024-35870 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs | 0.6% | — |
| CVE-2023-41843 | HIGH 7.5 | fortinet fortisandbox A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3 | 0.6% | — |
| CVE-2022-49003 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nvme: fix SRCU protection of nvme_ns_head list Walking the nvme_ns_head siblings list is protected by the head's srcu in nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths(). Remo | 0.6% | — |
| CVE-2026-61485 | HIGH 7.5 | apache lucy ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend | 0.6% | — |
| CVE-2026-23969 | MED 6.5 | apache superset Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was | 0.6% | — |
| CVE-2024-49988 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: add refcnt to ksmbd_conn struct When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd | 0.6% | — |
| CVE-2024-43516 | HIGH 7.8 | microsoft windows_10_1507 Windows Secure Kernel Mode Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-38820 | LOW 3.1 | vmware spring_framework The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected. | 0.6% | — |
| CVE-2024-36911 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and | 0.6% | — |
| CVE-2024-21364 | CRIT 9.3 | microsoft azure_site_recovery Microsoft Azure Site Recovery Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2023-28291 | HIGH 8.4 | microsoft raw_image_extension Raw Image Extension Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2023-23398 | HIGH 7.1 | microsoft 365_apps Microsoft Excel Spoofing Vulnerability | 0.6% | — |
| CVE-2022-38170 | MED 4.7 | apache airflow In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users t | 0.6% | — |
| CVE-2022-35792 | HIGH 7.8 | microsoft windows_10 Storage Spaces Direct Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-42300 | MED 6.0 | microsoft azure_sphere Azure Sphere Tampering Vulnerability | 0.6% | — |