60.375 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.375 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-1343 | MED 5.9 | microsoft visual_studio_live_share An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Share Information Disclosure Vulnerability'. | 2.9% | — |
| CVE-2022-29131 | HIGH 8.8 | microsoft windows_10 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2.9% | — |
| CVE-2022-29129 | HIGH 8.8 | microsoft windows_10 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2.9% | — |
| CVE-2022-29128 | HIGH 8.8 | microsoft windows_10 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2.9% | — |
| CVE-2020-13958 | HIGH 7.8 | apache openoffice A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal pr | 2.9% | — |
| CVE-2018-19452 | HIGH 7.8 | foxitsoftware foxit_pdf_sdk_activex A use after free in the TextBox field Mouse Enter action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-20 | 2.9% | — |
| CVE-2008-1214 | HIGH 7.5 | numara footprints MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from | 2.9% | — |
| CVE-2021-27263 | LOW 3.3 | foxitsoftware foxit_reader This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicio | 2.9% | — |
| CVE-2020-4001 | CRIT 9.8 | vmware sd-wan_orchestrator The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack. | 2.9% | — |
| CVE-2014-1664 | MED 5.0 | citrix gotomeeting The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file. | 2.9% | — |
| CVE-2022-27479 | CRIT 9.8 | apache superset Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue. | 2.9% | — |
| CVE-2008-5537 | HIGH 9.3 | pctools pctools_antivirus PC Tools AntiVirus 4.4.2.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a | 2.9% | — |
| CVE-2008-5523 | HIGH 9.3 | avast avast_antivirus avast! antivirus 4.8.1281.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a | 2.9% | — |
| CVE-2008-5522 | HIGH 9.3 | avg antivirus AVG Anti-Virus 8.0.0.161, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .t | 2.9% | — |
| CVE-2018-5512 | HIGH 7.5 | f5 big-ip_access_policy_manager On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload (LRO) and SYN cookies are enabled (default settings), undisclosed traffic patterns may cause TMM to restart. | 2.9% | — |
| CVE-2011-1180 | CRIT 9.8 | linux linux_kernel Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by le | 2.9% | — |
| CVE-2007-5587 | MED 6.9 | macrovision safedisc Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and | 2.9% | — |
| CVE-2008-4933 | HIGH 7.8 | linux linux_kernel Buffer overflow in the hfsplus_find_cat function in fs/hfsplus/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfsplus filesystem image with an invalid catalog namelength | 2.9% | — |
| CVE-2022-21925 | MED 5.3 | microsoft windows_7 Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability | 2.9% | — |
| CVE-2022-21924 | MED 5.3 | microsoft windows_10 Workstation Service Remote Protocol Security Feature Bypass Vulnerability | 2.9% | — |
| CVE-2026-61400 | HIGH 8.8 | apache cloudstack Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to in | 2.9% | — |
| CVE-2006-6589 | MED 6.8 | apache ofbiz Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCH_STRING parameter, a different issue tha | 2.9% | — |
| CVE-2025-21189 | MED 4.3 | microsoft windows_10_1507 MapUrlToZone Security Feature Bypass Vulnerability | 2.9% | — |
| CVE-2020-17082 | HIGH 7.8 | microsoft raw_image_extension Raw Image Extension Remote Code Execution Vulnerability | 2.9% | — |
| CVE-2019-14897 | CRIT 9.8 | canonical ubuntu_linux A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecti | 2.9% | — |