59.422 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.422 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-0004 | MED 6.5 | fedoraproject fedora A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity | 1.1% | — |
| CVE-2022-20726 | MED 5.5 | cisco cgr1000_compute_module Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system | 1.1% | — |
| CVE-2018-13102 | HIGH 7.8 | anydesk anydesk AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability. | 1.1% | — |
| CVE-2008-1471 | HIGH 7.2 | panda panda_antivirus_and_firewall The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system crash or kernel panic), overwrite memory, or execute arbitrary code via a crafted IOCTL request that triggers an out-of-b | 1.1% | — |
| CVE-2026-26125 | HIGH 8.6 | microsoft payment_orchestrator_service Payment Orchestrator Service Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2022-45048 | HIGH 8.4 | apache ranger Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0. | 1.1% | — |
| CVE-2022-20733 | MED 5.3 | cisco identity_services_engine A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Asser | 1.1% | — |
| CVE-2015-4324 | MED 6.1 | cisco nx-os Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.81), Nexus 3000 devices 7.3(0)ZN(0.81), Nexus 4000 devices 4.1(2)E1(1c), Nexus 7000 devices 7.2(0)N1(0.1), and Nexus 9000 devices 7.3(0)ZN(0.81) allows remote attackers to caus | 1.1% | — |
| CVE-2024-37981 | HIGH 8.0 | microsoft windows_10_1809 Secure Boot Security Feature Bypass Vulnerability | 1.1% | — |
| CVE-2024-37977 | HIGH 8.0 | microsoft windows_11_21h2 Secure Boot Security Feature Bypass Vulnerability | 1.1% | — |
| CVE-2023-25601 | MED 4.3 | apache dolphinscheduler On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version | 1.1% | — |
| CVE-2021-29678 | HIGH 8.7 | ibm db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority to access other databases and read or modify files. IBM X-Force ID: 199914. | 1.1% | — |
| CVE-2013-6693 | MED 5.4 | cisco 7600_router The MLDP implementation in Cisco IOS 15.3(3)S and earlier on 7600 routers, when many VRFs are configured, allows remote attackers to cause a denial of service (chunk corruption and device reload) by establishing many multicast flows, aka Bug ID CSCue22345. | 1.1% | — |
| CVE-2023-39264 | MED 4.3 | apache superset By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0. | 1.1% | — |
| CVE-2022-48748 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix memory leak in __allowed_ingress When using per-vlan state, if vlan snooping and stats are disabled, untagged or priority-tagged ingress frame will go to check pvid st | 1.1% | — |
| CVE-2022-3523 | MED 5.3 | linux linux_kernel A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. I | 1.1% | — |
| CVE-2021-33391 | CRIT 9.8 | htacg tidy An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c. | 1.1% | — |
| CVE-2021-22026 | HIGH 7.5 | vmware cloud_foundation The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leadin | 1.1% | — |
| CVE-2020-1470 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted a | 1.1% | — |
| CVE-2019-16150 | MED 5.5 | fortinet forticlient Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensiti | 1.1% | — |
| CVE-2017-4920 | MED 5.9 | vmware nsx-v_edge The implementation of the OSPF protocol in VMware NSX-V Edge 6.2.x prior to 6.2.8 and NSX-V Edge 6.3.x prior to 6.3.3 doesn't correctly handle the link-state advertisement (LSA). A rogue LSA may exploit this issue resulting in continuous sending of LSAs betwee | 1.1% | — |
| CVE-2013-3406 | MED 6.8 | cisco service_portal The "Files Available for Download" implementation in the Cisco Intelligent Automation for Cloud component in Cisco Services Portal 9.4(1) allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCug65687. | 1.1% | — |
| CVE-2022-42444 | MED 4.9 | ibm app_connect_enterprise IBM App Connect Enterprise 11.0.0.8 through 11.0.0.19 and 12.0.1.0 through 12.0.5.0 is vulnerable to a buffer overflow. A remote privileged user could overflow a buffer and cause the application to crash. IBM X-Force ID: 238538. | 1.1% | — |
| CVE-2020-3973 | HIGH 8.8 | arista velocloud_orchestrator The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged. | 1.1% | — |
| CVE-2020-1485 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows Image Acquisition (WIA) Service improperly discloses contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s syst | 1.1% | — |