59.356 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.356 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-25250 | MED 4.3 | fortinet fortios An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow | 0.5% | — |
| CVE-2025-24473 | LOW 3.7 | fortinet forticlient A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindows 7.0.13 through 7.0.14 may allow an unauthorized remote attacker to view application information vi | 0.5% | — |
| CVE-2025-21287 | HIGH 7.8 | microsoft windows_10_1507 Windows Installer Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2025-20209 | HIGH 7.5 | cisco ios_xr A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an affected device from processing any control plane UDP packets. This vulnerability is due to | 0.5% | — |
| CVE-2025-20142 | HIGH 8.6 | cisco ios_xr A vulnerability in the IPv4 access control list (ACL) feature and quality of service (QoS) policy feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Perf | 0.5% | — |
| CVE-2023-29359 | HIGH 7.8 | microsoft windows_10_1507 GDI Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-44697 | HIGH 7.8 | microsoft windows_10 Windows Graphics Component Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-41077 | HIGH 7.8 | microsoft windows_10 Windows Fax Compose Form Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-24530 | HIGH 7.8 | microsoft windows_10 Windows Installer Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-22401 | MED 5.9 | ibm aspera_faspex IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567. | 0.5% | — |
| CVE-2021-36968 | HIGH 7.8 | microsoft windows_7 Windows DNS Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2021-33110 | MED 6.5 | intel ac_1550_firmware Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access. | 0.5% | — |
| CVE-2021-3031 | MED 4.3 | paloaltonetworks pan-os Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information | 0.5% | — |
| CVE-2020-36386 | HIGH 7.1 | linux linux_kernel An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. | 0.5% | — |
| CVE-2015-5283 | MED 4.7 | linux linux_kernel The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of | 0.5% | — |
| CVE-2004-1387 | LOW 2.1 | apache http_server The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files. | 0.5% | — |
| CVE-2026-9639 | MED 6.5 | canonical lxd Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that o | 0.5% | — |
| CVE-2026-92121 | HIGH 7.5 | apache wss4j In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stop | 0.5% | — |
| CVE-2026-85922 | HIGH 7.4 | microsoft azure-keyvault-administration Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. | 0.5% | — |
| CVE-2026-47340 | MED 6.5 | apache dolphinscheduler Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, w | 0.5% | — |
| CVE-2026-24305 | CRIT 9.3 | microsoft entra_id Azure Entra ID Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2026-105715 | HIGH 7.5 | microsoft 365_apps Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 0.5% | — |
| CVE-2026-105714 | HIGH 7.5 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | 0.5% | — |
| CVE-2026-105599 | HIGH 7.5 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | 0.5% | — |
| CVE-2026-105592 | HIGH 7.5 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | 0.5% | — |