57.971 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.971 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-43630 | HIGH 7.8 | microsoft windows_10_21h2 Windows Kernel Elevation of Privilege Vulnerability | 3.6% | — |
| CVE-2022-34720 | HIGH 7.5 | microsoft windows_10 Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability | 3.6% | — |
| CVE-2021-1668 | HIGH 7.8 | microsoft windows_10 Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability | 3.6% | — |
| CVE-2009-1197 | MED 5.3 | apache juddi Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp. | 3.6% | — |
| CVE-2006-4572 | HIGH 7.5 | linux linux_kernel ip6_tables in netfilter in the Linux kernel before 2.6.16.31 allows remote attackers to (1) bypass a rule that disallows a protocol, via a packet with the protocol header not located immediately after the fragment header, aka "ip6_tables protocol bypass bug;" | 3.6% | — |
| CVE-2020-0604 | HIGH 7.8 | microsoft visual_studio_code A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the curre | 3.6% | — |
| CVE-2019-17556 | CRIT 9.8 | apache olingo Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's | 3.6% | — |
| CVE-2017-2963 | HIGH 7.8 | adobe acrobat Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion engine, related to handling of the color profile in a TIFF file. Successful exploi | 3.6% | — |
| CVE-2017-8613 | HIGH 8.1 | microsoft azure_active_directory_connect Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability." | 3.6% | — |
| CVE-2018-0968 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass, aka "Windows Kernel Information Disclosure Vulnerability." T | 3.6% | — |
| CVE-2010-4671 | HIGH 7.8 | cisco ios The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS before 15.0(1)XA5 allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages with different source | 3.6% | — |
| CVE-2019-8008 | HIGH 8.8 | adobe acrobat_dc Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful e | 3.6% | — |
| CVE-2018-8388 | MED 4.3 | microsoft edge A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8383. | 3.6% | — |
| CVE-2018-15998 | HIGH 7.8 | adobe acrobat_dc Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a buff | 3.6% | — |
| CVE-2012-1583 | MED 5.0 | linux linux_kernel Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets. | 3.6% | — |
| CVE-2014-0490 | HIGH 7.5 | debian advanced_package_tool The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package. | 3.6% | — |
| CVE-2012-4444 | MED 5.0 | linux linux_kernel The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments. | 3.6% | — |
| CVE-2014-2613 | HIGH 9.0 | hp release_control Unspecified vulnerability in HP Release Control 9.x before 9.13 p3 and 9.2x before RC 9.21.0003 p1 on Windows and 9.2x before RC 9.21.0002 p1 on Linux allows remote authenticated users to gain privileges via unknown vectors. | 3.6% | — |
| CVE-2006-3594 | HIGH 7.5 | cisco unified_callmanager Buffer overflow in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows remote attackers to execute arbitrary code via a long hostname in a SIP request, aka bug CSCsd96542. | 3.6% | — |
| CVE-2022-45047 | CRIT 9.8 | apache sshd Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD | 3.6% | — |
| CVE-2022-26832 | HIGH 7.5 | microsoft .net_framework .NET Framework Denial of Service Vulnerability | 3.6% | — |
| CVE-2020-0761 | HIGH 8.8 | microsoft windows_server_2008 <p>A remote code execution vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Accou | 3.6% | — |
| CVE-2020-0718 | HIGH 8.8 | microsoft windows_server_2008 <p>A remote code execution vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Accou | 3.6% | — |
| CVE-2019-19060 | HIGH 7.5 | broadcom brocade_fabric_operating_system_firmware A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41. | 3.6% | — |
| CVE-2022-41099 | MED 4.6 | microsoft windows_10 BitLocker Security Feature Bypass Vulnerability | 3.6% | — |