60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.368 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-0976 | MED 5.4 | microsoft sharepoint_enterprise_server A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020- | 2.2% | — |
| CVE-2019-12811 | CRIT 9.8 | activesoft mybuilder ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. This can be leveraged for code execution | 2.2% | — |
| CVE-2018-10142 | HIGH 7.5 | paloaltonetworks expedition The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system. | 2.2% | — |
| CVE-2001-1192 | HIGH 7.5 | citrix ica_client Citrix Independent Computing Architecture (ICA) Client for Windows 6.1 allows remote malicious web sites to execute arbitrary code via a .ICA file, which is downloaded and automatically executed by the client. | 2.2% | — |
| CVE-2020-4355 | MED 5.3 | ibm db2 IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service, caused by improper handling of Secure Sockets Layer (SSL) renegotiation requests. By sending specially-crafted requests, a r | 2.2% | — |
| CVE-2020-3225 | HIGH 8.6 | cisco ios Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of servi | 2.2% | — |
| CVE-2014-0262 | HIGH 7.2 | microsoft windows_7 win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k | 2.2% | — |
| CVE-2025-21308 | MED 6.5 | microsoft windows_10_1507 Windows Themes Spoofing Vulnerability | 2.2% | — |
| CVE-2017-12251 | CRIT 9.9 | cisco cloud_services_platform_2100 A vulnerability in the web console of the Cisco Cloud Services Platform (CSP) 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines (VMs) operating remotely on an affected CSP device. The vulnerability | 2.2% | — |
| CVE-2015-4310 | MED 4.3 | cisco finesse Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975. | 2.2% | — |
| CVE-2020-9653 | HIGH 7.8 | adobe premiere_pro Adobe Premiere Pro versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2.2% | — |
| CVE-2018-1319 | MED 6.1 | apache allura In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service denial for the victim's browsing session. | 2.2% | — |
| CVE-2016-6360 | HIGH 7.5 | cisco email_security_appliance A vulnerability in Advanced Malware Protection (AMP) for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition due to the AMP process unexpec | 2.2% | — |
| CVE-2015-1212 | HIGH 7.5 | canonical ubuntu_linux Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact via unknown vectors. | 2.2% | — |
| CVE-2016-6364 | HIGH 7.5 | cisco unified_communications_manager The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls, aka Bug ID CSCux67855. | 2.2% | — |
| CVE-2014-2170 | HIGH 9.0 | cisco telepresence_tc_software Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202. | 2.2% | — |
| CVE-2012-3076 | HIGH 9.0 | cisco telepresence_recording_server The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Bug ID CSCth85804. | 2.2% | — |
| CVE-2012-3075 | HIGH 9.0 | cisco telepresence_system_1300_65 The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724. | 2.2% | — |
| CVE-2011-2887 | MED 4.3 | ibm lotus_symphony IBM Lotus Symphony 3 before FP3 on Linux allows remote attackers to cause a denial of service (application crash) via a certain sample document. | 2.2% | — |
| CVE-2019-1903 | MED 6.5 | cisco security_manager A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit | 2.2% | — |
| CVE-2019-1743 | HIGH 8.8 | cisco ios_xe A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could explo | 2.2% | — |
| CVE-2018-0370 | HIGH 7.5 | cisco secure_firewall_management_center A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine processes to run out of memory and thus slow down traffic processing. The vulnerability is due to im | 2.2% | — |
| CVE-2007-5617 | HIGH 10.0 | vmware player Unspecified vulnerability in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1, prevents it from launching, which has unspecified impact, related to untrusted virtual machine images. | 2.2% | — |
| CVE-2002-1595 | MED 5.0 | cisco sn_5420_storage_router_firmware Cisco SN 5420 Storage Router 1.1(5) and earlier allows attackers to read configuration files without authorization. | 2.2% | — |
| CVE-2021-44712 | MED 5.5 | adobe acrobat Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. Exploitation of thi | 2.2% | — |