60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.368 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2008-2159 | LOW 2.1 | microsoft internet_explorer Microsoft Internet Explorer 7 can save encrypted pages in the cache even when the DisableCachingOfSSLPages registry setting is enabled, which might allow local users to obtain sensitive information. | 2.1% | — |
| CVE-2024-38028 | HIGH 7.2 | microsoft windows_10_1507 Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2024-38025 | HIGH 7.2 | microsoft windows_10_1507 Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2021-1705 | MED 4.2 | microsoft edge Microsoft Edge (HTML-based) Memory Corruption Vulnerability | 2.1% | — |
| CVE-2019-0557 | MED 5.4 | microsoft sharepoint_server A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoi | 2.1% | — |
| CVE-2016-6815 | MED 6.5 | apache ranger In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role. | 2.1% | — |
| CVE-2015-0768 | MED 6.5 | cisco prime_network_control_system The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute comma | 2.1% | — |
| CVE-2000-0486 | MED 5.0 | cisco ios Buffer overflow in Cisco TACACS+ tac_plus server allows remote attackers to cause a denial of service via a malformed packet with a long length field. | 2.1% | — |
| CVE-2021-44739 | MED 4.3 | adobe acrobat Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NT | 2.1% | — |
| CVE-2021-44702 | MED 4.3 | adobe acrobat Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NT | 2.1% | — |
| CVE-2018-4270 | MED 6.5 | apple icloud A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6. | 2.1% | — |
| CVE-2014-1736 | HIGH 7.5 | google chrome Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length valu | 2.1% | — |
| CVE-2013-4690 | MED 5.0 | juniper junos Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX1400, SRX3400, and SRX3600 does not properly initialize memory locations used during padding of Ethernet packe | 2.1% | — |
| CVE-2021-25640 | MED 6.1 | apache dubbo In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability. | 2.1% | — |
| CVE-2018-15462 | HIGH 8.6 | cisco secure_firewall_threat_defense A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulti | 2.1% | — |
| CVE-2016-5331 | MED 6.1 | vmware esxi CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. | 2.1% | — |
| CVE-2014-2313 | MED 4.3 | atlassian jira Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors. | 2.1% | — |
| CVE-2025-52434 | HIGH 7.5 | apache tomcat Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue aff | 2.1% | — |
| CVE-2023-34478 | CRIT 9.8 | apache shiro Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update | 2.1% | — |
| CVE-2020-3336 | HIGH 7.2 | cisco roomos A vulnerability in the software upgrade process of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software could allow an authenticated, remote attacker to modify the filesystem to cause a denial of service (DoS) or gain privileged access | 2.1% | — |
| CVE-2015-4182 | MED 5.5 | cisco identity_services_engine_software The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087. | 2.1% | — |
| CVE-2002-0720 | HIGH 7.2 | microsoft windows_2000 A handler routine for the Network Connection Manager (NCM) in Windows 2000 allows local users to gain privileges via a complex attack that causes the handler to run in the LocalSystem context with user-specified code. | 2.1% | — |
| CVE-2001-0016 | HIGH 7.2 | microsoft windows_nt NTLM Security Support Provider (NTLMSSP) service does not properly check the function number in an LPC request, which could allow local users to gain administrator level access. | 2.1% | — |
| CVE-2024-26163 | MED 4.7 | microsoft edge_chromium Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 2.1% | — |
| CVE-2018-4232 | MED 4.3 | apple icloud An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKi | 2.1% | — |