57.057 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.057 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-52524 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. | 0.2% | — |
| CVE-2023-29532 | MED 5.5 | mozilla firefox A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-l | 0.2% | — |
| CVE-2023-28514 | MED 6.2 | ibm mq IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398. | 0.2% | — |
| CVE-2023-25839 | HIGH 7.0 | esri arcgis_insights There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted i | 0.2% | — |
| CVE-2023-24486 | MED 5.5 | citrix workspace A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same computer from which t | 0.2% | — |
| CVE-2023-20193 | MED 6.0 | cisco identity_services_engine A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate their privileges to root. To exploit this vulnerability, an | 0.2% | — |
| CVE-2022-50301 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fix buffer overflow in debugfs There are two issues here: 1) The "len" variable needs to be checked before the very first write. Otherwise if omap2_iommu_dump_ctx() with "byt | 0.2% | — |
| CVE-2022-49921 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: sched: Fix use after free in red_enqueue() We can't use "skb" again after passing it to qdisc_enqueue(). This is basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb le | 0.2% | — |
| CVE-2022-49597 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctl_tcp_base_mss. While reading sysctl_tcp_base_mss, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. | 0.2% | — |
| CVE-2022-49596 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctl_tcp_min_snd_mss. While reading sysctl_tcp_min_snd_mss, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. | 0.2% | — |
| CVE-2022-49585 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. While reading sysctl_tcp_fastopen_blackhole_timeout, it can be changed concurrently. Thus, we need to add READ_ONCE() to it | 0.2% | — |
| CVE-2022-49580 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. While reading sysctl_fib_multipath_use_neigh, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. | 0.2% | — |
| CVE-2022-49579 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. While reading sysctl_fib_multipath_hash_policy, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers | 0.2% | — |
| CVE-2022-49578 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ip: Fix data-races around sysctl_ip_prot_sock. sysctl_ip_prot_sock is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protectio | 0.2% | — |
| CVE-2022-49577 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctl_udp_l3mdev_accept. While reading sysctl_udp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. | 0.2% | — |
| CVE-2022-46301 | LOW 1.9 | intel unison_software Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. | 0.2% | — |
| CVE-2022-46298 | LOW 1.9 | intel unison_software Incomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. | 0.2% | — |
| CVE-2022-30531 | MED 4.4 | intel iris_xe_max_dedicated_graphics Out-of-bounds read in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1474 may allow a privileged user to potentially enable information disclosure via local access. | 0.2% | — |
| CVE-2021-47534 | MED 4.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: drm/vc4: kms: Add missing drm_crtc_commit_put Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a global state for the HVS, with each FIFO storing | 0.2% | — |
| CVE-2021-31821 | MED 5.5 | octopus tentacle When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image | 0.2% | — |
| CVE-2020-5899 | HIGH 7.8 | f5 nginx_controller In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a pa | 0.2% | — |
| CVE-2019-1808 | MED 4.4 | cisco nx-os A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to impro | 0.2% | — |
| CVE-2019-0071 | HIGH 7.8 | juniper junos Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versions of Junos OS, affecting specific EX Series platforms, the Veriexec subsystem will fail to initializ | 0.2% | — |
| CVE-2026-7947 | MED 4.2 | google chrome Insufficient validation of untrusted input in Network in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-63020 | LOW 3.1 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message i | 0.2% | — |