59.646 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.646 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-33230 | HIGH 7.3 | nvidia cuda_toolkit NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation | 1.4% | — |
| CVE-2021-1262 | HIGH 7.8 | cisco catalyst_sd-wan_manager Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more informa | 1.4% | — |
| CVE-2020-35513 | MED 4.9 | linux linux_kernel A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process tha | 1.4% | — |
| CVE-2020-0794 | MED 5.5 | microsoft windows_10 A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. | 1.4% | — |
| CVE-2007-0084 | MED 6.6 | microsoft message_compiler Buffer overflow in the Windows NT Message Compiler (MC) 1.00.5239 on Microsoft Windows XP allows local users to gain privileges via a long MC-filename. NOTE: this issue has been disputed by a reliable third party who states that the compiler is not a privileg | 1.4% | — |
| CVE-2024-31862 | MED 5.3 | apache zeppelin Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue. | 1.4% | — |
| CVE-2021-3347 | HIGH 7.8 | debian debian_linux An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458. | 1.4% | — |
| CVE-2016-7271 | HIGH 7.8 | microsoft windows_10 The Secure Kernel Mode implementation in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows local users to bypass the virtual trust level (VTL) protection mechanism via a crafted application, aka "Secure Kernel Mode Elevation of Privilege | 1.4% | — |
| CVE-2010-2289 | MED 4.3 | juniper secure_access Open redirect vulnerability in dana/home/homepage.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Location parameter. | 1.4% | — |
| CVE-2008-2300 | MED 6.5 | citrix access_essentials Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors. | 1.4% | — |
| CVE-2007-1537 | LOW 3.6 | microsoft windows_2003_server \Device\NdisTapi (NDISTAPI.sys) in Microsoft Windows XP SP2 and 2003 SP1 uses weak permissions, which allows local users to write to the device and cause a denial of service, as demonstrated by using an IRQL to acquire a spinlock on paged memory via the NdisTa | 1.4% | — |
| CVE-2006-4983 | HIGH 7.5 | cisco network_access_control Cisco NAC allows quarantined devices to communicate over the network with (1) DNS, (2) DHCP, and (3) EAPoUDP, which allows attackers to bypass control methods by tunneling network traffic through one of these protocols. | 1.4% | — |
| CVE-2025-50166 | MED 6.5 | microsoft windows_10_1507 Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network. | 1.4% | — |
| CVE-2019-1765 | HIGH 8.1 | cisco ip_conference_phone_8832_firmware A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficien | 1.4% | — |
| CVE-2019-11702 | MED 6.5 | mozilla firefox A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if a user approves execution when prompted. *Note: this issue only occurs on Windows. Other operating sy | 1.4% | — |
| CVE-2018-18332 | HIGH 7.5 | trendmicro officescan A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other files and folders on vulnerable installations. | 1.4% | — |
| CVE-2018-18331 | HIGH 7.5 | trendmicro officescan A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter the files, which could lead to other exploits on vulnerable installations. | 1.4% | — |
| CVE-2014-1955 | MED 4.3 | fortinet fortiweb Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 1.4% | — |
| CVE-2013-5097 | MED 4.0 | juniper junos_space Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive i | 1.4% | — |
| CVE-2000-0311 | LOW 2.1 | microsoft windows_2000 The Windows 2000 domain controller allows a malicious user to modify Active Directory information by modifying an unprotected attribute, aka the "Mixed Object Access" vulnerability. | 1.4% | — |
| CVE-1999-0889 | HIGH 7.5 | cisco 675_router Cisco 675 routers running CBOS allow remote attackers to establish telnet sessions if an exec or superuser password has not been set. | 1.4% | — |
| CVE-2026-20306 | CRIT 9.1 | A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have | 1.4% | — |
| CVE-2025-21343 | HIGH 7.5 | microsoft windows_11_22h2 Windows Web Threat Defense User Service Information Disclosure Vulnerability | 1.4% | — |
| CVE-2021-27075 | MED 6.8 | microsoft azure_container_instances Azure Virtual Machine Information Disclosure Vulnerability | 1.4% | — |
| CVE-2020-0672 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0668, CVE-2020-0669, CVE-2020-0670, CVE-2020-0671. | 1.4% | — |