58.449 CVE tracked
792 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.449 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-6913 | HIGH 8.8 | perkinelmer processplus Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0. | 1.4% | — |
| CVE-2024-21447 | HIGH 7.8 | microsoft windows_10_21h2 Windows Authentication Elevation of Privilege Vulnerability | 1.4% | — |
| CVE-2024-21347 | HIGH 7.5 | microsoft windows_10_1507 Microsoft ODBC Driver Remote Code Execution Vulnerability | 1.4% | — |
| CVE-2023-42787 | MED 6.5 | fortinet fortianalyzer A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web consol | 1.4% | — |
| CVE-2019-11700 | MED 6.5 | mozilla firefox A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affe | 1.4% | — |
| CVE-2016-4945 | MED 6.1 | citrix netscaler_gateway_11.0_firmware Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSC_TMAC cookie. | 1.4% | — |
| CVE-2015-6356 | MED 4.3 | cisco socialminer Cross-site scripting (XSS) vulnerability in the WeChat page in Cisco Social Miner 10.0(1) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuw60212. | 1.4% | — |
| CVE-2014-3325 | MED 4.3 | cisco unified_customer_voice_portal Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Customer Voice Portal (CVP) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug IDs CSCuh61711, CSCuh61720, CSCuh61723, CSCuh61726, CSCuh61727, CSCu | 1.4% | — |
| CVE-2014-3265 | MED 4.3 | cisco security_manager Cross-site scripting (XSS) vulnerability in the Auto Update Server (AUS) web framework in Cisco Security Manager 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuo06900. | 1.4% | — |
| CVE-2013-1178 | HIGH 8.3 | cisco cg-os Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(4) and 6.x before 6.1(1), Nexus 5000 and 5500 devices 4.x and 5.x before 5.1(3)N1(1), Nexus 4000 devices before 4.1(2)E1( | 1.4% | — |
| CVE-2023-35352 | HIGH 7.5 | microsoft windows_server_2012 Windows Remote Desktop Security Feature Bypass Vulnerability | 1.4% | — |
| CVE-2023-32019 | MED 4.7 | microsoft windows_10_1607 Windows Kernel Information Disclosure Vulnerability | 1.4% | — |
| CVE-2023-2598 | HIGH 7.8 | linux linux_kernel A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalat | 1.4% | — |
| CVE-2021-37839 | MED 4.3 | apache superset Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics. | 1.4% | — |
| CVE-2019-1171 | MED 5.6 | microsoft windows_10 An information disclosure vulnerability exists in SymCrypt during the OAEP decryption stage. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker | 1.4% | — |
| CVE-2025-55227 | HIGH 8.8 | microsoft sql_server_2016 Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | 1.4% | — |
| CVE-2021-41335 | HIGH 7.8 | microsoft windows_10 Windows Kernel Elevation of Privilege Vulnerability | 1.4% | — |
| CVE-2020-0943 | MED 4.6 | microsoft your_phone_companion An authentication bypass vulnerability exists in Microsoft YourPhoneCompanion application for Android, in the way the application processes notifications generated by work profiles.This could allow an unauthenticated attacker to view notifications, aka 'Micros | 1.4% | — |
| CVE-2015-6365 | MED 4.0 | cisco ios Cisco IOS 15.2(04)M and 15.4(03)M lets physical-interface ACLs supersede virtual PPP interface ACLs, which allows remote authenticated users to bypass intended network-traffic restrictions in opportunistic circumstances by using PPP, aka Bug ID CSCur61303. | 1.4% | — |
| CVE-2015-6347 | MED 4.0 | cisco secure_access_control_server The Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to bypass intended RBAC restrictions, and create a dashboard or portlet, by visiting an unspecified web page. | 1.4% | — |
| CVE-2011-1885 | HIGH 7.2 | microsoft windows_2003_server win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted applica | 1.4% | — |
| CVE-2011-1880 | HIGH 7.2 | microsoft windows_2003_server win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted applica | 1.4% | — |
| CVE-2026-48323 | CRIT 10.0 | adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to | 1.4% | — |
| CVE-2026-20847 | MED 6.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network. | 1.4% | — |
| CVE-2024-47685 | CRIT 9.1 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_z | 1.4% | — |