60.375 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.375 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-15717 | MED 6.1 | apache sling_xss_protection_api A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected version | 2.9% | — |
| CVE-2010-4682 | HIGH 7.8 | cisco 5500_series_adaptive_security_appliance Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allows remote attackers to cause a denial of service (memory consumption) by making multiple incorrect LDAP authentication attempts, aka Bug ID CSCtf29867. | 2.9% | — |
| CVE-2021-31205 | MED 6.5 | microsoft windows_10 Windows SMB Client Security Feature Bypass Vulnerability | 2.9% | — |
| CVE-2014-0721 | HIGH 10.0 | cisco unified_sip_phone_3905 The Cisco Unified SIP Phone 3905 with firmware before 9.4(1) allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574. | 2.9% | — |
| CVE-2023-36560 | HIGH 8.8 | microsoft .net_framework ASP.NET Security Feature Bypass Vulnerability | 2.9% | — |
| CVE-2023-32254 | CRIT 9.8 | linux linux_kernel A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. A | 2.9% | — |
| CVE-2019-1703 | HIGH 8.6 | cisco secure_firewall_threat_defense A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 2100 Series could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulti | 2.9% | — |
| CVE-2019-12407 | MED 6.1 | apache jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the vict | 2.9% | — |
| CVE-2019-12404 | MED 6.1 | apache jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some s | 2.9% | — |
| CVE-2019-10087 | MED 6.1 | apache jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and | 2.9% | — |
| CVE-2022-32250 | HIGH 7.8 | debian debian_linux net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. | 2.9% | — |
| CVE-2021-31214 | HIGH 7.8 | microsoft visual_studio_code Visual Studio Code Remote Code Execution Vulnerability | 2.9% | — |
| CVE-2016-4921 | HIGH 7.5 | juniper junos By flooding a Juniper Networks router running Junos OS with specially crafted IPv6 traffic, all available resources can be consumed, leading to the inability to store next hop information for legitimate traffic. In extreme cases, the crafted IPv6 traffic may r | 2.9% | — |
| CVE-2006-3945 | MED 5.0 | opera opera_browser The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption. | 2.9% | — |
| CVE-2021-26439 | MED 4.6 | microsoft edge Microsoft Edge for Android Information Disclosure Vulnerability | 2.9% | — |
| CVE-2017-12216 | HIGH 8.8 | cisco socialminer A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entit | 2.9% | — |
| CVE-2012-4086 | MED 5.1 | cisco unified_computing_system A setup script for fabric interconnect devices in Cisco Unified Computing System (UCS) allows remote attackers to execute arbitrary commands via invalid parameters, aka Bug ID CSCtg20790. | 2.9% | — |
| CVE-2021-38669 | MED 6.4 | microsoft edge Microsoft Edge (Chromium-based) Tampering Vulnerability | 2.9% | — |
| CVE-2021-26876 | HIGH 8.8 | microsoft windows_10 OpenType Font Parsing Remote Code Execution Vulnerability | 2.9% | — |
| CVE-2019-18282 | MED 5.3 | debian debian_linux The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash | 2.9% | — |
| CVE-2015-4512 | MED 6.4 | mozilla firefox gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive inform | 2.9% | — |
| CVE-2010-1085 | HIGH 7.1 | linux linux_kernel The azx_position_ok function in hda_intel.c in Linux kernel 2.6.33-rc4 and earlier, when running on the AMD780V chip set, allows context-dependent attackers to cause a denial of service (crash) via unknown manipulations that trigger a divide-by-zero error. | 2.9% | — |
| CVE-2004-1235 | MED 6.2 | avaya converged_communications_server Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor. | 2.9% | — |
| CVE-2010-1571 | HIGH 7.8 | cisco customer_response_solution Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), unspecified 6.0 versions, and 5.0 before 5.0(2)SR3 allows remote attackers to read arbitrary files via a crafted bootstra | 2.9% | — |
| CVE-2018-18013 | HIGH 7.8 | citrix xenmobile_server * Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a | 2.9% | — |