60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.368 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-0670 | MED 6.4 | cisco spa300_firmware The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSC | 1.8% | — |
| CVE-2015-0062 | HIGH 7.2 | microsoft windows_7 Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges via a crafted application that leverages incorrect impersonation handling in a proces | 1.8% | — |
| CVE-2012-2553 | HIGH 7.2 | microsoft windows_7 Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application, | 1.8% | — |
| CVE-2012-2530 | HIGH 7.2 | microsoft windows_7 Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via | 1.8% | — |
| CVE-2024-26222 | HIGH 7.2 | microsoft windows_server_2016 Windows DNS Server Remote Code Execution Vulnerability | 1.8% | — |
| CVE-2020-35769 | CRIT 9.8 | webmin webmin miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program. | 1.8% | — |
| CVE-2015-5369 | MED 4.3 | juniper pulse_connect_secure Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, do | 1.8% | — |
| CVE-2015-0570 | HIGH 7.8 | linux linux_kernel Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, all | 1.8% | — |
| CVE-2007-3285 | MED 6.8 | mozilla firefox Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which | 1.8% | — |
| CVE-2022-32223 | HIGH 7.3 | nodejs node.js Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files | 1.8% | — |
| CVE-2013-3898 | HIGH 7.9 | microsoft windows_8 Microsoft Windows 8 and Windows Server 2012, when Hyper-V is used, does not ensure memory-address validity, which allows guest OS users to execute arbitrary code in all guest OS instances, and allows guest OS users to cause a denial of service (host OS crash), | 1.8% | — |
| CVE-2026-26171 | HIGH 7.5 | microsoft .net Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. | 1.8% | — |
| CVE-2021-39824 | HIGH 7.8 | adobe premiere_elements Adobe Premiere Elements version 2021.2235820 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious png file, potentially resulting in arbitrary code execution in the context of the current user. User interaction | 1.8% | — |
| CVE-2018-13381 | MED 5.3 | fortinet fortios A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service | 1.8% | — |
| CVE-2017-1000379 | HIGH 7.8 | linux linux_kernel The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected. | 1.8% | — |
| CVE-2013-6965 | MED 5.0 | cisco webex_training_center The registration component in Cisco WebEx Training Center provides the training-session URL before e-mail confirmation is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields | 1.8% | — |
| CVE-2013-1213 | MED 5.0 | cisco nexus_1000v Cisco NX-OS on the Nexus 1000V does not assign the proper priority to heartbeat messages from a Virtual Ethernet Module (VEM) to a Virtual Supervisor Module (VSM), which allows remote attackers to cause a denial of service (false VEM unavailability report) via | 1.8% | — |
| CVE-2013-1193 | MED 5.0 | cisco adaptive_security_appliance_software The Secure Shell (SSH) implementation on Cisco Adaptive Security Appliances (ASA) devices, and in Cisco Firewall Services Module (FWSM), does not properly terminate sessions, which allows remote attackers to cause a denial of service (SSH service outage) by re | 1.8% | — |
| CVE-2024-30101 | HIGH 7.5 | microsoft 365_apps Microsoft Office Remote Code Execution Vulnerability | 1.8% | — |
| CVE-2021-31440 | HIGH 7.0 | linux linux_kernel This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specif | 1.8% | — |
| CVE-2020-1945 | MED 6.3 | apache ant Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the tem | 1.8% | — |
| CVE-2018-8042 | HIGH 8.1 | apache ambari Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie. | 1.8% | — |
| CVE-2017-8989 | CRIT 9.1 | hp icewall_sso A security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could be exploited remotely to allow URL Redirection. | 1.8% | — |
| CVE-2019-1077 | MED 5.0 | microsoft visual_studio_2017 An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studio Elevation of Privilege Vulnerability'. | 1.8% | — |
| CVE-2017-0518 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Qualcomm fingerprint sensor driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privil | 1.8% | — |