58.135 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.135 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-41032 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: check if a hash-index is in cpu_possible_mask The problem is that there are systems where cpu_possible_mask has gaps between set CPUs, for example SPARC. In this scenario addr_ | 0.3% | — |
| CVE-2024-41028 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quirks[] together with the standard DMI matching functions, it must be terminated by a empty entry. Si | 0.3% | — |
| CVE-2024-40925 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: block: fix request.queuelist usage in flush Friedrich Weber reported a kernel crash problem and bisected to commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine"). The | 0.3% | — |
| CVE-2024-39745 | MED 5.9 | ibm sterling_connect_direct_web_services IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | 0.3% | — |
| CVE-2024-39382 | MED 5.5 | adobe after_effects After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue | 0.3% | — |
| CVE-2024-27052 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop() | 0.3% | — |
| CVE-2024-20385 | MED 5.9 | cisco nexus_dashboard_orchestrator A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitive information from an affected device. This vulnerability exists because the Cisco NDO Valid | 0.3% | — |
| CVE-2023-50431 | MED 5.5 | linux linux_kernel sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->pad0 is not initialized. | 0.3% | — |
| CVE-2023-48681 | MED 6.1 | acronis cyber_protect Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. | 0.3% | — |
| CVE-2022-49725 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setup_tx_descriptors After PF reset and ethtool -t there was call trace in dmesg sometimes leading to panic. When there was some time, around 5 seconds, between reset | 0.3% | — |
| CVE-2022-49672 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: tun: unlink NAPI from device on destruction Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we ha | 0.3% | — |
| CVE-2022-49291 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, whic | 0.3% | — |
| CVE-2022-49054 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests hv_panic_page might contain guest-sensitive information, do not dump it over to Hyper-V by default in iso | 0.3% | — |
| CVE-2022-48422 | HIGH 7.8 | onlyoffice document_server ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located. | 0.3% | — |
| CVE-2022-45798 | HIGH 7.8 | trendmicro apex_one A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. Ple | 0.3% | — |
| CVE-2022-44669 | HIGH 7.0 | microsoft windows_10 Windows Error Reporting Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2022-38890 | MED 5.5 | f5 njs Nginx NJS v0.7.7 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h | 0.3% | — |
| CVE-2022-36774 | MED 5.3 | ibm robotic_process_automation IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575. | 0.3% | — |
| CVE-2022-29594 | HIGH 7.8 | eginnovations eg_agent eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM. | 0.3% | — |
| CVE-2022-22962 | HIGH 7.8 | vmware horizon VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful exploitation can result in linking to a root owned file. | 0.3% | — |
| CVE-2021-40795 | HIGH 7.8 | adobe premiere_pro Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute cod | 0.3% | — |
| CVE-2021-23023 | HIGH 7.8 | f5 big-ip_access_policy_manager On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evalu | 0.3% | — |
| CVE-2020-5896 | HIGH 7.8 | f5 big-ip_access_policy_manager On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions. | 0.3% | — |
| CVE-2020-4623 | MED 6.5 | ibm i2_ibase IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code | 0.3% | — |
| CVE-2019-19151 | MED 5.5 | f5 big-ip_access_policy_manager On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell ( | 0.3% | — |