60.375 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.375 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-16937 | MED 4.7 | microsoft .net_framework <p>An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory. An attacker who successfully exploited the vulnerability could disclose contents of an affected system's memory.</p> <p>To exploit the vulnerability | 3.3% | — |
| CVE-2017-5635 | HIGH 7.5 | apache nifi In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user. | 3.3% | — |
| CVE-2003-1327 | HIGH 9.3 | washington_university wu-ftpd Buffer overflow in the SockPrintf function in wu-ftpd 2.6.2 and earlier, when compiled with MAIL_ADMIN option enabled on a system that supports very long pathnames, might allow remote anonymous users to execute arbitrary code by uploading a file with a long pa | 3.3% | — |
| CVE-2020-17067 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Security Feature Bypass Vulnerability | 3.3% | — |
| CVE-2007-2450 | LOW 3.5 | apache tomcat Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authentic | 3.3% | — |
| CVE-2020-25643 | HIGH 7.2 | debian debian_linux A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of servic | 3.3% | — |
| CVE-2017-15714 | CRIT 9.8 | apache ofbiz The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "__format=%27;alert(%27xss%27)" to the URL an alert window | 3.3% | — |
| CVE-2015-4216 | MED 5.0 | cisco content_security_management_virtual_appliance The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different custom | 3.3% | — |
| CVE-2024-23109 | CRIT 10.0 | fortinet fortisiem An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests. | 3.3% | — |
| CVE-2021-36960 | HIGH 7.5 | microsoft windows_10 Windows SMB Information Disclosure Vulnerability | 3.3% | — |
| CVE-2020-1112 | HIGH 8.5 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handles uploaded content. An attacker who successfully exploited this vulnerability could upload restricted file types to an II | 3.3% | — |
| CVE-2019-19816 | HIGH 7.8 | canonical ubuntu_linux In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled. | 3.3% | — |
| CVE-2019-1871 | HIGH 7.2 | cisco integrated_management_controller_supervisor A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an | 3.3% | — |
| CVE-2008-4390 | HIGH 7.5 | cisco linksys_wvc54gc_firmware The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote-management command, which allows remote attackers to obtain sensitive information such as passwords by sniffing the net | 3.3% | — |
| CVE-2008-4934 | HIGH 7.8 | canonical ubuntu_linux The hfsplus_block_allocate function in fs/hfsplus/bitmap.c in the Linux kernel before 2.6.28-rc1 does not check a certain return value from the read_mapping_page function before calling kmap, which allows attackers to cause a denial of service (system crash) v | 3.3% | — |
| CVE-2023-38228 | HIGH 7.8 | adobe acrobat Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user in | 3.3% | — |
| CVE-2023-38227 | HIGH 7.8 | adobe acrobat Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user in | 3.3% | — |
| CVE-2018-8550 | HIGH 7.8 | microsoft windows_10 An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows | 3.3% | — |
| CVE-2010-1188 | HIGH 7.1 | linux linux_kernel Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listen | 3.3% | — |
| CVE-2026-24291 | HIGH 7.8 | microsoft windows_10_1607 Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally. | 3.3% | — |
| CVE-2023-21812 | HIGH 7.8 | microsoft windows_10 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 3.3% | — |
| CVE-2017-0180 | HIGH 7.6 | microsoft windows_10 A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Remote Code Execution Vulnerability." This CVE ID is | 3.3% | — |
| CVE-2015-1721 | HIGH 7.2 | microsoft windows_7 The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privil | 3.3% | — |
| CVE-2006-6333 | HIGH 7.8 | linux linux_kernel The tr_rx function in ibmtr.c for Linux kernel 2.6.19 assigns the wrong flag to the ip_summed field, which allows remote attackers to cause a denial of service (memory corruption) via crafted packets that cause the kernel to interpret another field as an offse | 3.3% | — |
| CVE-2002-1024 | HIGH 7.1 | cisco catos Cisco IOS 12.0 through 12.2, when supporting SSH, allows remote attackers to cause a denial of service (CPU consumption) via a large packet that was designed to exploit the SSH CRC32 attack detection overflow (CVE-2001-0144). | 3.3% | — |