60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-40730 | LOW 3.3 | adobe acrobat Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free that allow a remote attacker to disclose sensitive information on affected instal | 3.9% | — |
| CVE-2023-48315 | HIGH 8.8 | microsoft azure_rtos_netx_duo Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include p | 3.9% | — |
| CVE-2013-4563 | HIGH 7.1 | canonical ubuntu_linux The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to | 3.9% | — |
| CVE-2012-3054 | HIGH 9.3 | cisco webex_recording_format_player Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP11, T27 LD before SP32 CP2, and T28 L10N before SP1 allows remote attackers to execute arbitrary code via a craf | 3.9% | — |
| CVE-2021-28571 | HIGH 8.3 | adobe after_effects Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbitr | 3.9% | — |
| CVE-2024-39423 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue require | 3.9% | — |
| CVE-2024-21426 | HIGH 7.8 | microsoft sharepoint_server Microsoft SharePoint Server Remote Code Execution Vulnerability | 3.9% | — |
| CVE-2021-35997 | HIGH 7.8 | adobe premiere_pro Adobe Premiere Pro version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the curren | 3.9% | — |
| CVE-2007-6423 | HIGH 7.8 | apache http_server Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue | 3.9% | — |
| CVE-2021-26423 | HIGH 7.5 | microsoft .net .NET Core and Visual Studio Denial of Service Vulnerability | 3.9% | — |
| CVE-2020-3430 | HIGH 8.8 | cisco jabber A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers | 3.9% | — |
| CVE-2020-3375 | CRIT 9.8 | cisco ios_xe_sd-wan A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sendi | 3.9% | — |
| CVE-2020-0856 | MED 6.5 | microsoft windows_server_2008 <p>An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited this vulnerability would be able to read sensitive information about the target s | 3.9% | — |
| CVE-2017-0095 | HIGH 7.6 | microsoft windows_10 Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arbitrary code on a target OS, aka "Hyper-V vSMB Remote Code Execution Vulnerability." This vulnerabilit | 3.9% | — |
| CVE-2010-2657 | HIGH 9.3 | opera opera_browser Opera before 10.60 on Windows and Mac OS X does not properly prevent certain double-click operations from running a program located on a web site, which allows user-assisted remote attackers to execute arbitrary code via a crafted web page that bypasses a dial | 3.9% | — |
| CVE-1999-1455 | HIGH 7.5 | microsoft windows_nt RSH service utility RSHSVC in Windows NT 3.5 through 4.0 does not properly restrict access as specified in the .Rhosts file when a user comes from an authorized host, which could allow unauthorized users to access the service by logging in from an authorized h | 3.9% | — |
| CVE-1999-1316 | HIGH 7.5 | microsoft windows_nt Passfilt.dll in Windows NT SP2 allows users to create a password that contains the user's name, which could make it easier for an attacker to guess. | 3.9% | — |
| CVE-2025-49718 | HIGH 7.5 | microsoft sql_server_2019 Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network. | 3.9% | — |
| CVE-2020-0645 | HIGH 7.5 | microsoft windows_10 A tampering vulnerability exists when Microsoft IIS Server improperly handles malformed request headers, aka 'Microsoft IIS Server Tampering Vulnerability'. | 3.9% | — |
| CVE-2019-1642 | MED 6.1 | cisco secure_firewall_management_center A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the | 3.9% | — |
| CVE-2016-1006 | HIGH 8.1 | adobe air_desktop_runtime Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass the ASLR protection mechanism via JIT data. | 3.9% | — |
| CVE-2006-1527 | MED 5.0 | linux linux_kernel The SCTP-netfilter code in Linux kernel before 2.6.16.13 allows remote attackers to trigger a denial of service (infinite loop) via unknown vectors that cause an invalid SCTP chunk size to be processed by the for_each_sctp_chunk function. | 3.9% | — |
| CVE-2005-3176 | HIGH 7.5 | microsoft windows_2000 Microsoft Windows 2000 before Update Rollup 1 for SP4 does not record the IP address of a Windows Terminal Services client in a security log event if the client connects successfully, which could make it easier for attackers to escape detection. | 3.9% | — |
| CVE-2005-2872 | MED 5.0 | linux linux_kernel The ipt_recent kernel module (ipt_recent.c) in Linux kernel before 2.6.12, when running on 64-bit processors such as AMD64, allows remote attackers to cause a denial of service (kernel panic) via certain attacks such as SSH brute force, which leads to memset c | 3.9% | — |
| CVE-2000-0155 | HIGH 7.2 | microsoft windows_95 Windows NT Autorun executes the autorun.inf file on non-removable media, which allows local attackers to specify an alternate program to execute when other users access a drive. | 3.9% | — |