58.273 CVE tracked
789 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.273 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-3393 | MED 6.0 | cisco ios_xe A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execute IOS XE commands outside the application-hosting subsystem | 0.3% | — |
| CVE-2017-0318 | MED 5.5 | nvidia gpu_driver All versions of NVIDIA Linux GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper validation of an input parameter may cause a denial of service on the system. | 0.3% | — |
| CVE-2011-1016 | LOW 1.9 | linux linux_kernel The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Transla | 0.3% | — |
| CVE-2009-1883 | MED 4.4 | linux linux_kernel The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage. | 0.3% | — |
| CVE-2007-5498 | MED 4.9 | linux linux_kernel The Xen hypervisor block backend driver for Linux kernel 2.6.18, when running on a 64-bit host with a 32-bit paravirtualized guest, allows local privileged users in the guest OS to cause a denial of service (host OS crash) via a request that specifies a large | 0.3% | — |
| CVE-2006-5806 | LOW 2.1 | cisco secure_desktop SSL VPN Client in Cisco Secure Desktop before 3.1.1.45, when configured to spawn a web browser after a successful connection, stores sensitive browser session information in a directory outside of the CSD vault and does not restrict the user from saving files | 0.3% | — |
| CVE-2026-73239 | MED 6.5 | apache allura Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. | 0.3% | — |
| CVE-2026-49050 | HIGH 8.8 | apache dolphinscheduler General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue. | 0.3% | — |
| CVE-2026-23453 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, w | 0.3% | — |
| CVE-2026-20958 | MED 5.4 | microsoft sharepoint_server Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | 0.3% | — |
| CVE-2025-54257 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i | 0.3% | — |
| CVE-2025-37799 | HIGH 8.6 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MT | 0.3% | — |
| CVE-2025-27907 | MED 4.1 | ibm websphere_application_server IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | 0.3% | — |
| CVE-2025-22249 | HIGH 8.2 | vmware aria_automation VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious craf | 0.3% | — |
| CVE-2024-49939 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid to add interface to list twice when SER If SER L2 occurs during the WoWLAN resume flow, the add interface flow is triggered by ieee80211_reconfig(). However, due to rtw89_ | 0.3% | — |
| CVE-2023-52846 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it retur | 0.3% | — |
| CVE-2023-38042 | HIGH 7.8 | ivanti secure_access_client A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM. | 0.3% | — |
| CVE-2023-36555 | LOW 3.9 | fortinet fortios An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components. | 0.3% | — |
| CVE-2023-33951 | MED 6.7 | linux linux_kernel A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to | 0.3% | — |
| CVE-2023-23412 | HIGH 7.8 | microsoft windows_10_1507 Windows Accounts Picture Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2023-22870 | MED 5.9 | ibm aspera_faspex IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 244121. | 0.3% | — |
| CVE-2022-49022 | HIGH 8.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Fix possible out-of-bound access in ieee80211_get_rate_duration routine as reported by the following UBSAN report: UBSA | 0.3% | — |
| CVE-2022-48967 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check struct nfc_target arrays While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target-> | 0.3% | — |
| CVE-2022-38014 | HIGH 7.0 | microsoft azure_iot_edge_for_linux Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2022-31008 | MED 5.5 | broadcom rabbitmq_server RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This mean | 0.3% | — |