59.264 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.264 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2014-8481 | MED 4.9 | linux linux_kernel The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via | 0.6% | — |
| CVE-2026-57977 | HIGH 7.1 | microsoft edge_chromium Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-53571 | HIGH 7.5 | vitejs vite Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through serv | 0.6% | — |
| CVE-2026-23652 | CRIT 10.0 | microsoft power_pages Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network. | 0.6% | — |
| CVE-2025-55332 | MED 6.1 | microsoft windows_10_1809 Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | 0.6% | — |
| CVE-2025-55330 | MED 6.1 | microsoft windows_11_22h2 Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | 0.6% | — |
| CVE-2025-47181 | HIGH 8.8 | microsoft edge_update Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2025-23303 | HIGH 7.8 | nvidia nemo NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering. | 0.6% | — |
| CVE-2024-26641 | HIGH 8.6 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h var | 0.6% | — |
| CVE-2024-25037 | MED 4.3 | ibm cognos_controller IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. | 0.6% | — |
| CVE-2023-47152 | MED 5.9 | ibm db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. | 0.6% | — |
| CVE-2022-23298 | HIGH 7.0 | microsoft windows_10 Windows NT OS Kernel Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-23288 | HIGH 7.0 | microsoft windows_10 Windows DWM Core Library Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-23287 | HIGH 7.0 | microsoft windows_10 Windows ALPC Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2020-27171 | MED 6.0 | canonical ubuntu_linux An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigat | 0.6% | — |
| CVE-2018-20669 | HIGH 7.8 | canonical ubuntu_linux An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to over | 0.6% | — |
| CVE-2018-0249 | MED 4.3 | cisco aironet_access_point_software A vulnerability when handling incoming 802.11 Association Requests for Cisco Aironet 1800 Series Access Point (APs) on Qualcomm Atheros (QCA) based hardware platforms could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) conditio | 0.6% | — |
| CVE-2013-1848 | MED 6.2 | linux linux_kernel fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application. | 0.6% | — |
| CVE-2026-69904 | LOW 3.5 | microsoft sharepoint_server Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | 0.6% | — |
| CVE-2026-69876 | HIGH 8.0 | microsoft windows_10_1607 Use after free in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. | 0.6% | — |
| CVE-2026-69847 | HIGH 8.0 | microsoft windows_10_1607 Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. | 0.6% | — |
| CVE-2026-69777 | HIGH 8.0 | microsoft windows_11_24h2 Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. | 0.6% | — |
| CVE-2026-69412 | HIGH 8.0 | microsoft windows_10_1607 Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. | 0.6% | — |
| CVE-2026-58185 | MED 5.9 | apache traffic_server The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whi | 0.6% | — |
| CVE-2026-58160 | MED 6.5 | apache traffic_server Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, | 0.6% | — |