58.450 CVE tracked
793 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.450 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-39563 | HIGH 7.3 | juniper junos_space A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the | 1.3% | — |
| CVE-2024-29066 | HIGH 7.2 | microsoft windows_server_2008 Windows Distributed File System (DFS) Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2024-28746 | HIGH 8.1 | apache airflow Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airf | 1.3% | — |
| CVE-2023-47265 | MED 5.4 | apache airflow Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of th | 1.3% | — |
| CVE-2022-37956 | HIGH 7.8 | microsoft windows_10 Windows Kernel Elevation of Privilege Vulnerability | 1.3% | — |
| CVE-2022-22744 | HIGH 8.8 | mozilla firefox The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.<br>*This bug only affects Thunderbird for Windows. Other operating s | 1.3% | — |
| CVE-2021-20427 | HIGH 7.5 | ibm security_guardium IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314. | 1.3% | — |
| CVE-2018-5500 | MED 5.9 | f5 big-ip_access_policy_manager On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory. Virtual server using TCP profile with Multipath TCP (MCTCP) feature enabled will be affected by this | 1.3% | — |
| CVE-2018-15330 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the BIG-IP system will experience a fatal error and may cause the Traffic Management Microkernel (TMM) to | 1.3% | — |
| CVE-2018-15318 | HIGH 7.5 | f5 big-ip_access_policy_manager In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produc | 1.3% | — |
| CVE-2017-8824 | HIGH 7.8 | linux linux_kernel The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state. | 1.3% | — |
| CVE-2010-0484 | MED 6.8 | microsoft windows_2000 The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 "do not properly validate changes in certain kernel objects," which allows local users to execute arbi | 1.3% | — |
| CVE-2025-32714 | HIGH 7.8 | microsoft windows_10_1507 Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. | 1.3% | — |
| CVE-2023-27874 | CRIT 9.9 | ibm aspera_faspex IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845. | 1.3% | — |
| CVE-2021-41832 | HIGH 7.5 | apache openoffice It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory. | 1.3% | — |
| CVE-2021-23015 | HIGH 7.2 | f5 big-ip_access_policy_manager On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing u | 1.3% | — |
| CVE-2005-0921 | MED 4.6 | microsoft outlook_connector Microsoft Outlook 2002 Connector for IBM Lotus Domino 2.0 allows local users to save passwords and login credentials locally, even when password caching is disabled by a group policy. | 1.3% | — |
| CVE-2023-32042 | MED 6.5 | microsoft windows_10_1507 OLE Automation Information Disclosure Vulnerability | 1.3% | — |
| CVE-2020-3955 | CRIT 9.3 | vmware esxi ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluated the severity of this issue to be in the Important severity | 1.3% | — |
| CVE-2018-0044 | CRIT 9.8 | juniper junos An insecure SSHD configuration in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices may allow remote unauthenticated access if any of the passwords on the system are empty. The affected SSHD configuration has the PermitEmptyPasswords optio | 1.3% | — |
| CVE-2017-5106 | MED 6.5 | debian debian_linux Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | 1.3% | — |
| CVE-2017-5105 | MED 6.5 | debian debian_linux Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | 1.3% | — |
| CVE-2013-5531 | MED 5.0 | cisco identity_services_engine_software Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuration and credentials data, via a crafted session on TCP port 443, aka Bug ID CSCty20405. | 1.3% | — |
| CVE-2003-0897 | MED 4.6 | microsoft windows_xp "Shatter" vulnerability in CommCtl32.dll in Windows XP may allow local users to execute arbitrary code by sending (1) BCM_GETTEXTMARGIN or (2) BCM_SETTEXTMARGIN button control messages to privileged applications. | 1.3% | — |
| CVE-2024-45784 | HIGH 7.5 | apache airflow Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users | 1.3% | — |