58.441 CVE tracked
792 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.441 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2001-0621 | HIGH 7.5 | cisco content_services_switch_11000 The FTP server on Cisco Content Service 11000 series switches (CSS) before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands. | 1.4% | — |
| CVE-1999-0496 | HIGH 7.2 | microsoft windows_nt A Windows NT 4.0 user can gain administrative rights by forcing NtOpenProcessToken to succeed regardless of the user's permissions, aka GetAdmin. | 1.4% | — |
| CVE-2024-26251 | MED 6.8 | microsoft sharepoint_server Microsoft SharePoint Server Spoofing Vulnerability | 1.4% | — |
| CVE-2023-44323 | MED 5.5 | microsoft edge_chromium Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation | 1.4% | — |
| CVE-2022-22979 | HIGH 7.5 | vmware spring_cloud_function In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework. | 1.4% | — |
| CVE-2020-4161 | MED 6.5 | ibm db2 IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect handling of certain commands. IBM X-Force ID: 174341. | 1.4% | — |
| CVE-2017-6720 | MED 6.5 | cisco esw2-350g-52_firmware A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a reload of the affected switch, resulting in a denial of service (DoS) condition. The vulnerability is | 1.4% | — |
| CVE-2017-5110 | MED 6.5 | debian debian_linux Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. | 1.4% | — |
| CVE-2017-5101 | MED 6.5 | debian debian_linux Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. | 1.4% | — |
| CVE-2017-5067 | MED 6.5 | google chrome An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | 1.4% | — |
| CVE-2015-1805 | HIGH 7.2 | google android The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of ser | 1.4% | — |
| CVE-2014-2151 | MED 4.0 | cisco adaptive_security_appliance_software The WebVPN portal in Cisco Adaptive Security Appliance (ASA) Software 8.4(.7.15) and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file, aka Bug ID CSCui04520. | 1.4% | — |
| CVE-2011-3640 | HIGH 7.1 | google chrome Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor | 1.4% | — |
| CVE-2007-2876 | MED 6.1 | linux linux_kernel The sctp_new function in (1) ip_conntrack_proto_sctp.c and (2) nf_conntrack_proto_sctp.c in Netfilter in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, allows remote attackers to cause a denial of service by causing certain invalid states tha | 1.4% | — |
| CVE-2002-1092 | HIGH 7.5 | cisco vpn_3000_concentrator_series_software Cisco VPN 3000 Concentrator 3.6(Rel) and earlier, and 2.x.x, when configured to use internal authentication with group accounts and without any user accounts, allows remote VPN clients to log in using PPTP or IPSEC user authentication. | 1.4% | — |
| CVE-2025-64405 | HIGH 7.5 | apache openoffice Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc | 1.4% | — |
| CVE-2025-54106 | HIGH 8.8 | microsoft windows_server_2012 Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. | 1.4% | — |
| CVE-2025-49760 | LOW 3.5 | microsoft windows_10_1507 External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network. | 1.4% | — |
| CVE-2025-33230 | HIGH 7.3 | nvidia cuda_toolkit NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation | 1.4% | — |
| CVE-2023-35393 | MED 4.5 | microsoft azure_hdinsight Azure Apache Hive Spoofing Vulnerability | 1.4% | — |
| CVE-2022-0812 | MED 4.3 | linux linux_kernel An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user privileges to leak kernel information. | 1.4% | — |
| CVE-2017-3854 | HIGH 8.8 | cisco wireless_lan_controller_firmware A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to impersonate a WLC in a meshed topology. The vulnerability is due to insufficient authentication of the parent access point in a | 1.4% | — |
| CVE-2017-0097 | MED 5.4 | microsoft windows_10 Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of se | 1.4% | — |
| CVE-2015-6336 | HIGH 7.3 | cisco aironet_access_point_software Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attackers to obtain access via unspecified vectors, aka Bug ID CSCuw58062. | 1.4% | — |
| CVE-1999-1306 | HIGH 7.5 | cisco ios Cisco IOS 9.1 and earlier does not properly handle extended IP access lists when the IP route cache is enabled and the "established" keyword is set, which could allow attackers to bypass filters. | 1.4% | — |