58.560 CVE tracked
797 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.560 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-47639 | MED 5.4 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-47636 | MED 5.4 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-45465 | MED 5.4 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-45464 | MED 5.4 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-45453 | MED 5.4 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-30778 | HIGH 7.5 | apache skywalking The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue. | 0.6% | — |
| CVE-2025-54656 | MED 6.5 | apache struts_extras ** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without an | 0.6% | — |
| CVE-2023-45584 | MED 6.6 | fortinet fortios A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy | 0.6% | — |
| CVE-2023-4335 | HIGH 7.5 | broadcom raid_controller_web_interface Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux | 0.6% | — |
| CVE-2023-36729 | HIGH 7.8 | microsoft windows_10_1507 Named Pipe File System Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-38043 | MED 5.5 | microsoft windows_10 Windows Security Support Provider Interface Information Disclosure Vulnerability | 0.6% | — |
| CVE-2022-38026 | MED 5.5 | microsoft windows_10 Windows DHCP Client Information Disclosure Vulnerability | 0.6% | — |
| CVE-2022-38025 | MED 5.5 | microsoft windows_11 Windows Distributed File System (DFS) Information Disclosure Vulnerability | 0.6% | — |
| CVE-2022-37996 | MED 5.5 | microsoft windows_10 Windows Kernel Memory Information Disclosure Vulnerability | 0.6% | — |
| CVE-2021-33762 | HIGH 7.0 | microsoft azure_cyclecloud Azure CycleCloud Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2020-25670 | HIGH 7.8 | debian debian_linux A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations. | 0.6% | — |
| CVE-2020-17163 | HIGH 7.8 | microsoft python Visual Studio Code Python Extension Remote Code Execution Vulnerability | 0.6% | — |
| CVE-2019-15239 | HIGH 7.8 | debian debian_linux In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was inte | 0.6% | — |
| CVE-2015-4036 | HIGH 7.2 | linux linux_kernel Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPO | 0.6% | — |
| CVE-2014-8371 | MED 4.3 | vmware vcenter_server_appliance VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via | 0.6% | — |
| CVE-2014-7826 | HIGH 7.8 | linux linux_kernel kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a c | 0.6% | — |
| CVE-2013-4470 | MED 6.9 | linux linux_kernel The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a cr | 0.6% | — |
| CVE-2009-1961 | MED 4.7 | canonical ubuntu_linux The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creat | 0.6% | — |
| CVE-2026-58184 | HIGH 8.2 | apache traffic_server The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. | 0.6% | — |
| CVE-2026-41919 | CRIT 9.1 | apache ofbiz Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. | 0.6% | — |