59.667 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.667 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-1366 | MED 6.5 | cisco ios_xr The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows remote authenticated users to cause a denial of service (overwrite) via unspecified vectors, aka Bug ID | 1.4% | — |
| CVE-2014-3294 | MED 4.0 | cisco webex_meetings_server Cisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj8 | 1.4% | — |
| CVE-2014-0743 | MED 5.0 | cisco unified_communications_manager The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468 | 1.4% | — |
| CVE-2013-0895 | HIGH 7.5 | google chrome Google Chrome before 25.0.1364.97 on Linux, and before 25.0.1364.99 on Mac OS X, does not properly handle pathnames during copy operations, which might make it easier for remote attackers to execute arbitrary programs via unspecified vectors. | 1.4% | — |
| CVE-2012-0941 | MED 6.1 | fortinet fortios Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Endpoint Monitor, (2) Dialup List, or (3) L | 1.4% | — |
| CVE-2024-21416 | HIGH 8.1 | microsoft windows_10_1809 Windows TCP/IP Remote Code Execution Vulnerability | 1.4% | — |
| CVE-2023-36736 | MED 4.4 | microsoft identity_linux_broker Microsoft Identity Linux Broker Remote Code Execution Vulnerability | 1.4% | — |
| CVE-2019-9968 | HIGH 7.8 | xnview xnview_classic XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlQueueWorkItem. | 1.4% | — |
| CVE-2019-9967 | HIGH 7.8 | xnview xnview_classic XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlPrefixUnicodeString. | 1.4% | — |
| CVE-2019-9964 | HIGH 7.8 | xnview xnview_mp XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey. | 1.4% | — |
| CVE-2019-16152 | MED 6.5 | fortinet forticlient A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running under root privilege crashes via sending specially crafted IPC client requests to the fctsched process | 1.4% | — |
| CVE-2006-6410 | MED 4.6 | vmware workstation Buffer overflow in an ActiveX control in VMWare 5.5.1 allows local users to execute arbitrary code via a long VmdbDb parameter to the Initialize function. | 1.4% | — |
| CVE-2023-25695 | MED 5.3 | apache airflow Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2. | 1.4% | — |
| CVE-2021-1245 | MED 6.5 | cisco finesse Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could allow an unauthenticated, remote attacker to conduct a cross-s | 1.4% | — |
| CVE-2019-11272 | HIGH 7.3 | debian debian_linux Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a nul | 1.4% | — |
| CVE-2017-0074 | MED 5.4 | microsoft windows_10 Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of se | 1.4% | — |
| CVE-2015-6362 | MED 4.0 | cisco connected_grid_network_management_system The web GUI in Cisco Connected Grid Network Management System (CG-NMS) 3.0(0.35) and 3.0(0.54) allows remote authenticated users to bypass intended access restrictions and modify the configuration by leveraging the Monitor-Only role, aka Bug ID CSCuw42640. | 1.4% | — |
| CVE-2013-6938 | MED 5.0 | citrix netscaler_application_delivery_controller_firmware Unspecified vulnerability in the Service VM in Citrix NetScaler SDX 9.3 before 9.3-64.4 and 10.0 before 10.0-77.5 and Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows attackers to cause a den | 1.4% | — |
| CVE-2011-0378 | HIGH 8.3 | cisco telepresence_system_1000 The XML-RPC implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a TCP request, related to a "command injection vulnerability," aka Bug ID CSCtb52587. | 1.4% | — |
| CVE-2024-21447 | HIGH 7.8 | microsoft windows_10_21h2 Windows Authentication Elevation of Privilege Vulnerability | 1.4% | — |
| CVE-2020-3517 | HIGH 8.6 | cisco firepower_extensible_operating_system A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attack | 1.4% | — |
| CVE-2021-22012 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information. | 1.4% | — |
| CVE-2018-1000028 | HIGH 7.4 | linux linux_kernel Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server (nfsd) that can result in remote users reading or writing files they should not be able to via NFS. This atta | 1.4% | — |
| CVE-2016-2066 | HIGH 7.8 | linux linux_kernel Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory cor | 1.4% | — |
| CVE-2013-0891 | HIGH 7.5 | google chrome Integer overflow in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a blob. | 1.4% | — |