59.513 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.513 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-6938 | HIGH 7.5 | tableau tableau_server A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log files. | 1.2% | — |
| CVE-2019-1303 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerab | 1.2% | — |
| CVE-2018-8124 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 20 | 1.2% | — |
| CVE-2017-7533 | HIGH 7.0 | linux linux_kernel Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event | 1.2% | — |
| CVE-2014-0727 | HIGH 7.5 | cisco unified_communications_manager SQL injection vulnerability in the CallManager Interactive Voice Response (CMIVR) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318. | 1.2% | — |
| CVE-2014-0726 | HIGH 7.5 | cisco unified_communications_manager SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326. | 1.2% | — |
| CVE-2009-1162 | MED 4.3 | cisco ironport_asyncos Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web script or HTML via the referrer parameter. | 1.2% | — |
| CVE-2008-2163 | MED 4.3 | ibm lotus_quickr Cross-site scripting (XSS) vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors." | 1.2% | — |
| CVE-2007-5581 | MED 4.3 | cisco unified_meetingplace Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName and (2) LastName parameters. | 1.2% | — |
| CVE-2007-4633 | MED 4.3 | cisco call_manager Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to inject arbitrary web script or | 1.2% | — |
| CVE-1999-0160 | HIGH 7.5 | cisco ios Some classic Cisco IOS devices have a vulnerability in the PPP CHAP authentication to establish unauthorized PPP connections. | 1.2% | — |
| CVE-2026-40858 | HIGH 8.8 | apache camel The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache use | 1.2% | — |
| CVE-2024-5914 | CRIT 9.8 | paloaltonetworks cortex_xsoar_commonscripts A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container. | 1.2% | — |
| CVE-2023-34367 | MED 6.5 | microsoft windows_7 Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack (including many IoT devices). NOTE: The vendor | 1.2% | — |
| CVE-2012-1868 | MED 6.9 | microsoft windows_xp Race condition in the thread-creation implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 allows local users to gain privileges via a crafted application, aka "Win32k.sys Race Condition Vulnerability." | 1.2% | — |
| CVE-2012-1867 | HIGH 8.4 | microsoft windows_2003_server Integer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted T | 1.2% | — |
| CVE-2005-3174 | MED 4.6 | microsoft windows_2000 Microsoft Windows 2000 before Update Rollup 1 for SP4 allows users to log on to the domain, even when their password has expired, if the fully qualified domain name (FQDN) is 8 characters long. | 1.2% | — |
| CVE-2005-3171 | MED 4.6 | microsoft windows_2000 Microsoft Windows 2000 before Update Rollup 1 for SP4 records Event ID 1704 to indicate that Group Policy security settings were successfully updated, even when the processing fails such as when Ntuser.pol cannot be accessed, which could cause system administr | 1.2% | — |
| CVE-2026-42780 | MED 4.9 | f5 big-ip_ssl_orchestrator A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files. Note: Software versions which have reached End of Technical Support (EoTS) a | 1.2% | — |
| CVE-2023-36796 | HIGH 7.8 | microsoft .net Visual Studio Remote Code Execution Vulnerability | 1.2% | — |
| CVE-2023-36794 | HIGH 7.8 | microsoft .net Visual Studio Remote Code Execution Vulnerability | 1.2% | — |
| CVE-2023-36793 | HIGH 7.8 | microsoft .net Visual Studio Remote Code Execution Vulnerability | 1.2% | — |
| CVE-2023-36792 | HIGH 7.8 | microsoft .net Visual Studio Remote Code Execution Vulnerability | 1.2% | — |
| CVE-2022-22375 | HIGH 7.2 | ibm security_verify_privilege_on-premises IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 221681. | 1.2% | — |
| CVE-2021-40774 | MED 5.5 | adobe prelude Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of | 1.2% | — |