58.352 CVE tracked
792 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.352 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-69419 | HIGH 8.5 | microsoft azure_data_manager_for_energy Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network. | 0.4% | — |
| CVE-2026-58154 | HIGH 8.9 | apache traffic_server Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad | 0.4% | — |
| CVE-2026-41863 | MED 6.5 | vmware spring_ai Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Af | 0.4% | — |
| CVE-2026-33838 | HIGH 7.8 | microsoft windows_10_1607 Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-33102 | CRIT 9.3 | microsoft 365_copilot Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2025-49731 | LOW 3.1 | microsoft teams Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2025-31366 | MED 4.7 | fortinet fortios An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7 | 0.4% | — |
| CVE-2025-30657 | MED 5.3 | juniper junos An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a device configured for flow-monitoring | 0.4% | — |
| CVE-2024-46755 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the | 0.4% | — |
| CVE-2024-43756 | HIGH 7.8 | adobe photoshop Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vic | 0.4% | — |
| CVE-2024-39559 | MED 5.9 | juniper junos_os_evolved An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unauthenticated attacker to crash the device (vmcore) by sending a specific TCP packet over an established | 0.4% | — |
| CVE-2024-39553 | MED 6.5 | juniper junos_os_evolved An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availabil | 0.4% | — |
| CVE-2024-38207 | MED 6.3 | microsoft edge_chromium Microsoft Edge (HTML-based) Memory Corruption Vulnerability | 0.4% | — |
| CVE-2024-20795 | HIGH 7.8 | adobe animate Animate versions 23.0.4, 24.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim | 0.4% | — |
| CVE-2024-20341 | MED 6.1 | cisco adaptive_security_appliance_software A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against | 0.4% | — |
| CVE-2023-20886 | HIGH 8.8 | vmware workspace_one_uem VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user. | 0.4% | — |
| CVE-2022-1353 | HIGH 7.1 | debian debian_linux A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. | 0.4% | — |
| CVE-2022-1316 | HIGH 8.8 | zerotier zerotierone Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation | 0.4% | — |
| CVE-2021-44466 | HIGH 7.3 | leap bitmask_riseup_vpn Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower p | 0.4% | — |
| CVE-2021-20317 | MED 4.4 | debian debian_linux A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and event | 0.4% | — |
| CVE-2020-4265 | HIGH 7.3 | ibm i2_analysts_notebook IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbi | 0.4% | — |
| CVE-2017-15537 | MED 5.5 | linux linux_kernel The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace() or rt_sigreturn | 0.4% | — |
| CVE-2015-8709 | HIGH 7.0 | linux linux_kernel kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the pt | 0.4% | — |
| CVE-2009-2287 | MED 4.9 | canonical ubuntu_linux The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a cra | 0.4% | — |
| CVE-2008-3077 | MED 4.9 | linux linux_kernel arch/x86/kernel/ptrace.c in the Linux kernel before 2.6.25.10 on the x86_64 platform leaks task_struct references into the sys32_ptrace function, which allows local users to cause a denial of service (system crash) or have unspecified other impact via unknown | 0.4% | — |