59.422 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.422 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-0444 | HIGH 7.0 | google android An elevation of privilege vulnerability in the Realtek sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. | 1.1% | — |
| CVE-2013-5548 | MED 4.3 | cisco ios The IKEv2 implementation in Cisco IOS, when AES-GCM or AES-GMAC is used, allows remote attackers to bypass certain IPsec anti-replay features via IPsec tunnel traffic, aka Bug ID CSCuj47795. | 1.1% | — |
| CVE-2026-91006 | HIGH 8.8 | apache karaf Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into | 1.1% | — |
| CVE-2026-27172 | HIGH 8.8 | apache camel The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject( | 1.1% | — |
| CVE-2025-20374 | MED 4.9 | cisco unified_contact_center_express A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI feature | 1.1% | — |
| CVE-2020-3410 | HIGH 8.1 | cisco secure_firewall_management_center A vulnerability in the Common Access Card (CAC) authentication feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and access the FMC system. The attacker must have a valid CAC to | 1.1% | — |
| CVE-2020-2031 | MED 4.9 | paloaltonetworks pan-os An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issue a command from the command line interface that causes the component to stop responding. Repeated attempts to send this | 1.1% | — |
| CVE-2016-1404 | HIGH 7.5 | cisco ucs_invicta_c3124sa_appliance Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by sniffi | 1.1% | — |
| CVE-2011-3317 | MED 4.3 | cisco secure_access_control_server Multiple cross-site scripting (XSS) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192. | 1.1% | — |
| CVE-2007-1000 | HIGH 7.2 | linux linux_kernel The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference. | 1.1% | — |
| CVE-2025-24859 | HIGH 8.8 | apache roller A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing se | 1.1% | — |
| CVE-2023-21560 | MED 6.6 | microsoft windows_10_1607 Windows Boot Manager Security Feature Bypass Vulnerability | 1.1% | — |
| CVE-2021-31187 | HIGH 7.8 | microsoft windows_10 Windows WalletService Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2017-7662 | HIGH 8.8 | apache cxf_fediz Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in | 1.1% | — |
| CVE-2026-70166 | MED 6.5 | microsoft windows_10_1607 Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network. | 1.1% | — |
| CVE-2026-70119 | MED 6.5 | microsoft windows_server_2022 Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network. | 1.1% | — |
| CVE-2026-53421 | CRIT 9.8 | apache syncope Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Gro | 1.1% | — |
| CVE-2022-22159 | HIGH 7.5 | juniper junos A vulnerability in the NETISR network queue functionality of Juniper Networks Junos OS kernel allows an attacker to cause a Denial of Service (DoS) by sending crafted genuine packets to a device. During an attack, the routing protocol daemon (rpd) CPU may reac | 1.1% | — |
| CVE-2021-43067 | HIGH 8.3 | fortinet fortiauthenticator A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 facto | 1.1% | — |
| CVE-2021-31380 | MED 5.3 | juniper session_and_resource_control A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows th | 1.1% | — |
| CVE-2020-27133 | CRIT 9.9 | cisco jabber Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive informati | 1.1% | — |
| CVE-2019-13399 | MED 5.9 | fortinet fcm-mb40_firmware Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation. | 1.1% | — |
| CVE-2018-6757 | HIGH 7.5 | mcafee true_key Privilege Escalation vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware. | 1.1% | — |
| CVE-2018-5197 | HIGH 7.8 | tobesoft xplatform A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command parameters. An crafted ma | 1.1% | — |
| CVE-2017-2305 | HIGH 8.8 | juniper junos_space On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation. | 1.1% | — |