58.414 CVE tracked
792 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.414 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-21401 | CRIT 9.8 | microsoft entra_jira_sso_plugin Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability | 1.5% | — |
| CVE-2023-38184 | HIGH 7.5 | microsoft windows_10_1507 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2023-28275 | HIGH 8.8 | microsoft windows_10_1507 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2018-8651 | MED 5.4 | microsoft dynamics_nav A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynam | 1.5% | — |
| CVE-2018-4464 | HIGH 8.8 | apple icloud Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. | 1.5% | — |
| CVE-2018-4378 | HIGH 8.8 | apple icloud A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8. | 1.5% | — |
| CVE-2017-2671 | MED 5.5 | linux linux_kernel The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leve | 1.5% | — |
| CVE-2015-2023 | HIGH 8.8 | ibm i_access Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors. | 1.5% | — |
| CVE-2023-21703 | MED 6.5 | microsoft azure_data_box_gateway Azure Data Box Gateway Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2021-37980 | HIGH 7.4 | debian debian_linux Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows. | 1.5% | — |
| CVE-2021-24096 | HIGH 7.8 | microsoft windows_10 Windows Kernel Elevation of Privilege Vulnerability | 1.5% | — |
| CVE-2024-29995 | HIGH 8.1 | microsoft windows_10_1507 Windows Kerberos Elevation of Privilege Vulnerability | 1.5% | — |
| CVE-2023-24922 | MED 6.5 | microsoft dynamics_365 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability | 1.5% | — |
| CVE-2023-24906 | MED 6.5 | microsoft windows_10_1507 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | 1.5% | — |
| CVE-2023-24883 | MED 6.5 | microsoft windows_10_1507 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | 1.5% | — |
| CVE-2023-24870 | MED 6.5 | microsoft windows_10_1507 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | 1.5% | — |
| CVE-2023-24863 | MED 6.5 | microsoft windows_10_1507 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | 1.5% | — |
| CVE-2023-24857 | MED 6.5 | microsoft windows_10 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | 1.5% | — |
| CVE-2021-45059 | LOW 3.3 | adobe indesign Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Ex | 1.5% | — |
| CVE-2019-6637 | MED 6.5 | f5 big-ip_application_security_manager On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Li | 1.5% | — |
| CVE-2019-0646 | MED 5.4 | microsoft team_foundation_server A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team. | 1.5% | — |
| CVE-2019-0624 | MED 5.4 | microsoft skype_for_business A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype. | 1.5% | — |
| CVE-2009-0083 | HIGH 7.2 | microsoft windows_2000 The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 does not properly handle invalid pointers, which allows local users to gain privileges via an application that triggers use of a crafted pointer, aka "Windows Kernel Invalid Pointer | 1.5% | — |
| CVE-2024-29735 | MED 5.3 | apache airflow Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configur | 1.5% | — |
| CVE-2023-6356 | MED 6.5 | debian debian_linux A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ker | 1.5% | — |