59.529 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.529 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-1455 | MED 5.3 | microsoft sql_server_management_studio A denial of service vulnerability exists when Microsoft SQL Server Management Studio (SSMS) improperly handles files. An attacker could exploit the vulnerability to trigger a denial of service. To exploit the vulnerability, an attacker would first require exec | 1.2% | — |
| CVE-2017-6749 | MED 5.4 | cisco web_security_appliance A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected | 1.2% | — |
| CVE-2017-3868 | MED 6.1 | cisco unified_computing_system_director A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Informat | 1.2% | — |
| CVE-2017-3866 | MED 6.1 | cisco prime_service_catalog A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvc79842 C | 1.2% | — |
| CVE-2017-3848 | MED 6.1 | cisco prime_infrastructure A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information | 1.2% | — |
| CVE-2017-3802 | MED 6.1 | cisco unified_communications_manager A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc20679. Known Affected Relea | 1.2% | — |
| CVE-2016-8463 | MED 5.5 | linux linux_kernel A denial of service vulnerability in the Qualcomm FUSE file system could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android | 1.2% | — |
| CVE-2010-0485 | HIGH 7.8 | microsoft windows_2000 The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server 2008 R2 "do not properly validate all callback parameters when creating a new windo | 1.2% | — |
| CVE-2024-43487 | MED 6.5 | microsoft windows_10_1507 Windows Mark of the Web Security Feature Bypass Vulnerability | 1.2% | — |
| CVE-2022-30148 | MED 5.5 | microsoft windows_10 Windows Desired State Configuration (DSC) Information Disclosure Vulnerability | 1.2% | — |
| CVE-2021-31372 | HIGH 8.8 | juniper junos An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated J-Web attacker to escalate their privileges to root over the target device. This issue affects: Juniper Networks Junos OS All versions prior to 18.3 | 1.2% | — |
| CVE-2021-1638 | HIGH 7.7 | microsoft windows_10 Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software | 1.2% | — |
| CVE-2018-5543 | HIGH 8.8 | f5 big-ip_controller The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container. | 1.2% | — |
| CVE-2018-1009 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory, aka "Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Wi | 1.2% | — |
| CVE-2016-8435 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromis | 1.2% | — |
| CVE-2026-62837 | MED 6.5 | microsoft sharepoint_server Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | 1.2% | — |
| CVE-2023-36009 | MED 5.5 | microsoft 365_apps Microsoft Word Information Disclosure Vulnerability | 1.2% | — |
| CVE-2019-17557 | MED 5.4 | apache syncope It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string. | 1.2% | — |
| CVE-2018-0149 | MED 4.8 | cisco integrated_management_controller_supervisor A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director Software could allow an authenticated, remote attacker to conduct a Document Object Model-based (DOM-based), stored cross | 1.2% | — |
| CVE-2013-1222 | HIGH 7.8 | cisco unified_customer_voice_portal The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted (1) HTTP or (2) HT | 1.2% | — |
| CVE-2024-21399 | HIGH 8.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 1.2% | — |
| CVE-2022-34029 | CRIT 9.1 | f5 njs Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njs_scope_value at njs_scope.h. | 1.2% | — |
| CVE-2022-20891 | MED 4.7 | cisco rv110w_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpe | 1.2% | — |
| CVE-2018-0439 | HIGH 8.8 | cisco meeting_server A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to | 1.2% | — |
| CVE-2007-1467 | LOW 3.5 | cisco acs_solution_engine Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallMana | 1.2% | — |