56.713 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.713 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-21742 | HIGH 8.8 | microsoft sharepoint_foundation Microsoft SharePoint Server Remote Code Execution Vulnerability | 55.8% | — |
| CVE-2013-0025 | HIGH 9.3 | microsoft internet_explorer Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer SLayoutRun Use After Free Vulnerability." | 55.8% | — |
| CVE-2016-5387 | HIGH 8.1 | apache http_server The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's | 55.7% | — |
| CVE-2005-2124 | HIGH 7.6 | microsoft windows_2000 Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to "An unchecked buffer" and possibly buffer overflows, allows remote attackers to execute arbitrary code via a crafted Win | 55.7% | — |
| CVE-2022-21882 | HIGH 7.0 | ransomware microsoft windows_10_1809 Win32k Elevation of Privilege Vulnerability | 55.7% | |
| CVE-2025-21285 | HIGH 7.5 | microsoft windows_10_1507 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | 55.7% | — |
| CVE-2013-3520 | HIGH 7.5 | vmware vcenter_chargeback_manager VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors. | 55.6% | — |
| CVE-2025-58034 | HIGH 7.2 | fortinet fortiweb An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2 | 55.6% | |
| CVE-2019-14322 | HIGH 7.5 | palletsprojects werkzeug In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. | 55.5% | — |
| CVE-2002-0186 | HIGH 7.5 | microsoft sql_server Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." | 55.5% | — |
| CVE-2007-2931 | HIGH 9.3 | microsoft msn_messenger Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving video conversation handling in Web Cam and video chat sessions. | 55.5% | — |
| CVE-2021-29200 | CRIT 9.8 | apache ofbiz Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack | 55.4% | — |
| CVE-2018-8474 | HIGH 7.5 | microsoft lync_for_mac A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affects Microsoft Lync. | 55.4% | — |
| CVE-2005-1984 | HIGH 7.5 | microsoft windows_2000 Buffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message. | 55.3% | — |
| CVE-2022-43396 | HIGH 8.8 | apache kylin In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf. | 55.3% | — |
| CVE-2010-0266 | HIGH 9.3 | microsoft outlook Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted mes | 55.3% | — |
| CVE-2011-1966 | HIGH 10.0 | microsoft windows_server_2008 The DNS server in Microsoft Windows Server 2008 SP2, R2, and R2 SP1 does not properly handle NAPTR queries that trigger recursive processing, which allows remote attackers to execute arbitrary code via a crafted query, aka "DNS NAPTR Query Vulnerability." | 55.2% | — |
| CVE-2018-0125 | CRIT 9.8 | cisco rv132w_firmware A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system, including issuing com | 55.2% | |
| CVE-2006-1388 | HIGH 7.5 | microsoft ie Unspecified vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to execute HTA files via unknown vectors. | 55.1% | — |
| CVE-2004-0942 | MED 5.0 | apache http_server Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters. | 55.1% | — |
| CVE-2021-44521 | CRIT 9.1 | apache cassandra When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. | 55.0% | — |
| CVE-2018-0834 | HIGH 7.5 | microsoft chakracore Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CV | 54.9% | — |
| CVE-2007-4790 | HIGH 7.5 | microsoft internet_explorer Stack-based buffer overflow in certain ActiveX controls in (1) FPOLE.OCX 6.0.8450.0 and (2) Foxtlib.ocx, as used in the Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library; and Internet Explorer 5.01, 6 SP1 and SP2, and 7; allows remote attackers to execute arb | 54.9% | — |
| CVE-2003-0347 | HIGH 10.0 | microsoft office Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID parameter. | 54.9% | — |
| CVE-2008-2168 | MED 4.3 | apache http_server Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page. | 54.9% | — |