59.967 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.967 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-1637 | HIGH 7.8 | cisco webex_meetings_online A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software im | 1.5% | — |
| CVE-2011-0244 | MED 4.3 | apple safari WebKit in Apple Safari before 5.0.6 allows user-assisted remote attackers to read arbitrary files via vectors related to improper canonicalization of URLs within RSS feeds. | 1.5% | — |
| CVE-2010-4165 | MED 4.9 | linux linux_kernel The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, lead | 1.5% | — |
| CVE-2020-4879 | CRIT 9.8 | ibm cognos_controller IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847. | 1.5% | — |
| CVE-2018-4437 | HIGH 8.8 | apple icloud Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. | 1.5% | — |
| CVE-1999-0794 | MED 4.6 | microsoft excel Microsoft Excel does not warn a user when a macro is present in a Symbolic Link (SYLK) format file. | 1.5% | — |
| CVE-1999-0628 | MED 5.0 | freebsd freebsd The rwho/rwhod service is running, which exposes machine status and user information. | 1.5% | — |
| CVE-2024-23807 | CRIT 9.8 | apache xerces-c\+\+ The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD pro | 1.5% | — |
| CVE-2023-28983 | HIGH 8.8 | juniper junos_os_evolved An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, low privileged, network based attacker to inject shell commands and execute code. This issue affects J | 1.5% | — |
| CVE-2021-44879 | MED 5.5 | linux linux_kernel In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. | 1.5% | — |
| CVE-2021-36742 | HIGH 7.8 | trendmicro apex_one A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obta | 1.5% | |
| CVE-2020-3926 | MED 6.1 | changingtec servisign An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter. | 1.5% | — |
| CVE-2019-9548 | CRIT 10.0 | citrix application_delivery_management Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control. | 1.5% | — |
| CVE-2019-12292 | CRIT 9.8 | citrix appdna Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control. | 1.5% | — |
| CVE-2013-1223 | HIGH 7.8 | cisco unified_customer_voice_portal The log viewer in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly validate an unspecified parameter, which allows remote attackers to read arbitrary files via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub3837 | 1.5% | — |
| CVE-2010-3033 | HIGH 9.0 | cisco wireless_lan_controller_software Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different v | 1.5% | — |
| CVE-2010-2843 | HIGH 9.0 | cisco wireless_lan_controller_software Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different v | 1.5% | — |
| CVE-2010-2842 | HIGH 9.0 | cisco wireless_lan_controller_software Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different v | 1.5% | — |
| CVE-2006-6572 | MED 6.5 | citrix access_gateway Unspecified vulnerability in Citrix Advanced Access Control (AAC) Option 4.0, and Access Gateway 4.2 with Advanced Access Control 4.2, before 20061114, when the Browser-Only access feature is enabled, allows remote authenticated users to bypass access policies | 1.5% | — |
| CVE-2023-39913 | HIGH 8.8 | apache uimaj Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK.This issue affects Apache UIMA Java SDK: before 3.5.0. Users are recommended to upgrade to ver | 1.5% | — |
| CVE-2022-21838 | MED 5.5 | microsoft windows_10 Windows Cleanup Manager Elevation of Privilege Vulnerability | 1.5% | — |
| CVE-2018-0187 | MED 6.5 | cisco identity_services_engine A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information for privileged accounts. The vulnerability is due to the improper handling of confidential information. | 1.5% | — |
| CVE-2001-0350 | MED 4.6 | microsoft windows_2000 Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program wi | 1.5% | — |
| CVE-2024-21350 | HIGH 8.8 | microsoft windows_10_1507 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2023-34150 | MED 6.5 | apache any23 ** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage. | 1.5% | — |