60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.368 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-42010 | CRIT 9.8 | apache heron Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue. | 1.8% | — |
| CVE-2018-7273 | MED 5.5 | linux linux_kernel In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addr | 1.8% | — |
| CVE-2006-5585 | HIGH 7.2 | microsoft windows_2003_server The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability." | 1.8% | — |
| CVE-1999-1225 | MED 5.0 | digital ultrix rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not | 1.8% | — |
| CVE-2023-46302 | CRIT 9.8 | apache submarine Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests (usin | 1.8% | — |
| CVE-2023-29343 | HIGH 7.8 | microsoft windows_sysmon SysInternals Sysmon for Windows Elevation of Privilege Vulnerability | 1.8% | — |
| CVE-2022-34692 | MED 5.3 | microsoft exchange_server Microsoft Exchange Server Information Disclosure Vulnerability | 1.8% | — |
| CVE-2022-22931 | MED 4.3 | apache james Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by t | 1.8% | — |
| CVE-2021-21045 | HIGH 8.2 | adobe acrobat Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper access control vulnerability. An unauthenticated attacker could leverage this vulnerability to elevate p | 1.8% | — |
| CVE-2016-6273 | HIGH 7.5 | citrix license_server The lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) before 2015 SP5 and 2016 before R1 SP1, as used by Citrix License Server for Windows before 11.14.0.1 and Citrix License Server VPX before 11.14.0.1, allows remote attackers to cause | 1.8% | — |
| CVE-2023-36805 | HIGH 7.0 | microsoft windows_10_1507 Windows MSHTML Platform Security Feature Bypass Vulnerability | 1.8% | — |
| CVE-2010-4041 | CRIT 9.8 | google chrome The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access restrictions via unspecified vectors. | 1.8% | — |
| CVE-2009-0630 | HIGH 7.1 | cisco ios The (1) Cisco Unified Communications Manager Express; (2) SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport; (3) Secure Signaling and Media Encryption; (4) Blocks Extensible Exchange Protocol (BEEP); (5) Network Admission Control HTTP | 1.8% | — |
| CVE-2018-8654 | MED 6.5 | microsoft dynamics_365 An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'. | 1.8% | — |
| CVE-2011-2560 | HIGH 7.8 | cisco unified_communications_manager The Packet Capture Service in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x does not properly handle idle TCP connections, which allows remote attackers to cause a denial of service (memory consumption and restart) by making many co | 1.8% | — |
| CVE-2010-2836 | HIGH 7.8 | cisco ios Memory leak in the SSL VPN feature in Cisco IOS 12.4, 15.0, and 15.1, when HTTP port redirection is enabled, allows remote attackers to cause a denial of service (memory consumption) by improperly disconnecting SSL sessions, leading to connections that remain | 1.8% | — |
| CVE-2010-2833 | HIGH 7.8 | cisco ios Unspecified vulnerability in the NAT for H.225.0 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtd86472. | 1.8% | — |
| CVE-2010-2832 | HIGH 7.8 | cisco ios Unspecified vulnerability in the NAT for H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtf91428. | 1.8% | — |
| CVE-2010-2831 | HIGH 7.8 | cisco ios Unspecified vulnerability in the NAT for SIP implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic on UDP port 5060, aka Bug ID CSCtf17624. | 1.8% | — |
| CVE-2010-2829 | HIGH 7.8 | cisco ios Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (traceback and device reload) via crafted H.3 | 1.8% | — |
| CVE-2010-2828 | HIGH 7.8 | cisco ios Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (device reload) via crafted H.323 packets, ak | 1.8% | — |
| CVE-2010-2824 | HIGH 7.8 | cisco ace_module Unspecified vulnerability on the Cisco Application Control Engine (ACE) Module with software A2(1.x) before A2(1.6), A2(2.x) before A2(2.3), and A2(3.x) before A2(3.1) for Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a | 1.8% | — |
| CVE-2010-2822 | HIGH 7.8 | cisco ace_4710 Unspecified vulnerability in the RTSP inspection feature on the Cisco Application Control Engine (ACE) Module with software before A2(3.2) for Catalyst 6500 series switches and 7600 series routers, and the Cisco Application Control Engine (ACE) 4710 appliance | 1.8% | — |
| CVE-2022-41131 | HIGH 7.8 | apache airflow Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG | 1.8% | — |
| CVE-2014-0651 | MED 4.9 | cisco context_directory_agent The administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347. | 1.8% | — |