59.356 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.356 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-3138 | MED 4.6 | canonical ubuntu_linux The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint de | 0.5% | — |
| CVE-2016-3137 | MED 4.6 | canonical ubuntu_linux drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descript | 0.5% | — |
| CVE-2014-7283 | MED 4.9 | linux linux_kernel The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) | 0.5% | — |
| CVE-2004-2515 | HIGH 7.2 | vmware workstation Format string vulnerability in VMware Workstation 4.5.2 build-8848, if running with elevated privileges, might allow local users to execute arbitrary code via format string specifiers in command line arguments. NOTE: it is not clear if there are any default or | 0.5% | — |
| CVE-2026-24255 | HIGH 7.5 | nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vuln | 0.5% | — |
| CVE-2024-53146 | CRIT 9.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into s | 0.5% | — |
| CVE-2022-35749 | HIGH 7.8 | microsoft windows_10_1507 Windows Digital Media Receiver Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-35746 | HIGH 7.8 | microsoft windows_10_1507 Windows Digital Media Receiver Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-20860 | HIGH 7.4 | cisco nexus_dashboard A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates | 0.5% | — |
| CVE-2021-26099 | MED 4.4 | fortinet fortimail Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphert | 0.5% | — |
| CVE-2019-6699 | MED 5.4 | fortinet fortiadc An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field in the traffic group interface. | 0.5% | — |
| CVE-2019-4738 | MED 6.5 | ibm sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an authenticated user from the dashboard UI which could be used in further attacks against the system. IBM X-Force ID: 172753. | 0.5% | — |
| CVE-2019-1805 | MED 4.3 | cisco wireless_lan_controller_software A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to access a CLI instance on an affected device. The vulnera | 0.5% | — |
| CVE-2017-0448 | MED 5.5 | google android An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user p | 0.5% | — |
| CVE-2014-3122 | MED 4.9 | canonical ubuntu_linux The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires remo | 0.5% | — |
| CVE-2010-1966 | MED 4.6 | hp insight_control Unspecified vulnerability in HP Insight Control power management for Windows before 6.1 allows local users to read or modify data, or cause a denial of service, via unknown vectors. | 0.5% | — |
| CVE-2026-91048 | CRIT 9.8 | apache karaf The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer ro | 0.5% | — |
| CVE-2026-54048 | MED 5.3 | apache impala Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the | 0.5% | — |
| CVE-2026-32637 | ND | Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-d | 0.5% | — |
| CVE-2025-38439 | CRIT 9.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning | 0.5% | — |
| CVE-2025-24072 | HIGH 7.8 | microsoft windows_10_1507 Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-24059 | HIGH 7.8 | microsoft windows_10_1507 Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-24050 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-24048 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-24046 | HIGH 7.8 | microsoft windows_10_1507 Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | 0.5% | — |