58.306 CVE tracked
790 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.306 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-6656 | MED 5.9 | cisco ip_phone_8800_series A vulnerability in Session Initiation Protocol (SIP) call handling of Cisco IP Phone 8800 Series devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the SIP process unexpectedly restarting. All active pho | 1.7% | — |
| CVE-2014-2107 | HIGH 7.1 | cisco ios Cisco IOS 12.2 and 15.0 through 15.3, when used with the Kailash FPGA before 2.6 on RSP720-3C-10GE and RSP720-3CXL-10GE devices, allows remote attackers to cause a denial of service (route switch processor outage) via crafted IP packets, aka Bug ID CSCug84789. | 1.7% | — |
| CVE-2014-0718 | HIGH 7.1 | cisco ips_sensor_software The produce-verbose-alert feature in Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via fragmented packets, aka Bug ID CSCui91266. | 1.7% | — |
| CVE-2013-6941 | HIGH 10.0 | citrix netscaler_application_delivery_controller_firmware Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows users to "breakout" of the shell via unknown vectors. | 1.7% | — |
| CVE-2013-5549 | HIGH 7.1 | cisco ios_xr Cisco IOS XR 3.8.1 through 4.2.0 does not properly process fragmented packets within the RP-A, RP-B, PRP, and DRP-B route-processor components, which allows remote attackers to cause a denial of service (transmission outage) via (1) IPv4 or (2) IPv6 traffic, a | 1.7% | — |
| CVE-2007-2032 | HIGH 7.5 | cisco wireless_control_system Cisco Wireless Control System (WCS) before 4.0.96.0 has a hard-coded FTP username and password for backup operations, which allows remote attackers to read and modify arbitrary files via unspecified vectors related to "properties of the FTP server," aka Bug ID | 1.7% | — |
| CVE-2004-2365 | LOW 2.1 | microsoft windows_2003_server Memory leak in Microsoft Windows XP and Windows Server 2003 allows local users to cause a denial of service (memory exhaustion) by repeatedly creating and deleting directories using a non-standard tool such as smbmount. | 1.7% | — |
| CVE-2024-37342 | HIGH 7.1 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Information Disclosure Vulnerability | 1.7% | — |
| CVE-2024-37337 | HIGH 7.1 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Information Disclosure Vulnerability | 1.7% | — |
| CVE-2023-28297 | HIGH 8.8 | microsoft windows_10_1607 Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability | 1.7% | — |
| CVE-2022-20799 | MED 4.7 | cisco rv340_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. Thes | 1.7% | — |
| CVE-2021-1555 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1553 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1552 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1551 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1550 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1549 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2019-14211 | HIGH 7.5 | foxitsoftware phantompdf An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash due to the lack of proper validation of the existence of an object prior to performing operations on that object when executing JavaScript. | 1.7% | — |
| CVE-2012-0148 | HIGH 7.2 | microsoft windows_7 afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 on 64-bit platforms does not properly validate user-mode input passed to kerne | 1.7% | — |
| CVE-2011-1888 | HIGH 7.2 | microsoft windows_7 win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a | 1.7% | — |
| CVE-2021-40794 | HIGH 7.8 | adobe premiere_pro Adobe Premiere Pro version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to | 1.7% | — |
| CVE-2021-40793 | HIGH 7.8 | adobe premiere_pro Adobe Premiere Pro version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to | 1.7% | — |
| CVE-2019-1158 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise a user’s system. There are mu | 1.7% | — |
| CVE-2012-3289 | HIGH 7.8 | vmware esx VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to cause a denial of service (guest OS crash) via crafted traffic from a remote virtual device. | 1.7% | — |
| CVE-2004-1766 | MED 5.0 | The default installation of NetScreen-Security Manager before Feature Pack 1 does not enable encryption for communication with devices running ScreenOS 5.0, which allows remote attackers to obtain sensitive information via sniffing. | 1.7% | — |