58.273 CVE tracked
789 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.273 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2012-6542 | LOW 1.9 | linux linux_kernel The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an | 0.3% | — |
| CVE-2012-3329 | LOW 3.3 | ibm advanced_settings_utility IBM Advanced Settings Utility (ASU) through 3.62 and 3.70 through 9.21 and Bootable Media Creator (BoMC) through 2.30 and 3.00 through 9.21 on Linux allow local users to overwrite arbitrary files via a symlink attack on a (1) temporary file or (2) log file. | 0.3% | — |
| CVE-2010-4525 | LOW 1.9 | linux linux_kernel Linux kernel 2.6.33 and 2.6.34.y does not initialize the kvm_vcpu_events->interrupt.pad structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors. | 0.3% | — |
| CVE-2009-1147 | HIGH 7.2 | vmware ace Unspecified vulnerability in vmci.sys in the Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 2.0.x before 2.0.1 build 156745 allows local u | 0.3% | — |
| CVE-2004-2302 | LOW 2.6 | linux linux_kernel Race condition in the sysfs_read_file and sysfs_write_file functions in Linux kernel before 2.6.10 allows local users to read kernel memory and cause a denial of service (crash) via large offsets in sysfs files. | 0.3% | — |
| CVE-2026-69403 | MED 5.5 | microsoft windows_10_1607 Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-68076 | MED 5.4 | apache airflow Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an | 0.3% | — |
| CVE-2026-64068 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into s | 0.3% | — |
| CVE-2026-53178 | HIGH 8.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Add guards to ensure ie_length is large enough before subtracting fixed IE offsets to prevent unsigned integer un | 0.3% | — |
| CVE-2026-45811 | HIGH 7.5 | apache nimble Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severi | 0.3% | — |
| CVE-2026-31435 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment during retry Under certain circumstances, all the remaining subrequests from a read request will get abandoned during retry. The abandonment process expects the | 0.3% | — |
| CVE-2026-25766 | MED 5.3 | labstack echo Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, | 0.3% | — |
| CVE-2025-49692 | HIGH 7.8 | microsoft azure_connected_machine_agent Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-37954 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't | 0.3% | — |
| CVE-2025-13631 | HIGH 8.8 | google chrome Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a crafted file. (Chromium security severity: High) | 0.3% | — |
| CVE-2024-23979 | HIGH 7.5 | f5 big-ip_access_policy_manager When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software versions which ha | 0.3% | — |
| CVE-2024-20326 | HIGH 7.8 | cisco confd_basic A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due t | 0.3% | — |
| CVE-2023-38211 | HIGH 7.8 | adobe dimension Adobe Dimension version 3.4.9 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 0.3% | — |
| CVE-2023-21596 | HIGH 7.8 | adobe incopy Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in th | 0.3% | — |
| CVE-2023-20233 | MED 4.3 | cisco ios_xr A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect processing | 0.3% | — |
| CVE-2022-49928 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_create_link_sd+0x40/0xd0 Read of size | 0.3% | — |
| CVE-2022-20865 | MED 6.7 | cisco firepower_4110_firmware A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The attacker would need to have Administrator privileges on the device. This vulnerability is du | 0.3% | — |
| CVE-2022-1389 | LOW 3.1 | f5 big-ip_access_policy_manager On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to | 0.3% | — |
| CVE-2021-26100 | MED 5.9 | fortinet fortimail A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaint | 0.3% | — |
| CVE-2021-1057 | HIGH 7.8 | nvidia virtual_gpu_manager NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the guest is not authorized, which may lead to integrity and confidentiality loss, denial of service, or i | 0.3% | — |