58.689 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.689 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-58740 | MED 5.5 | milner imagedirector_capture The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local attacker to decrypt database credentials by reading the cryptographic key from the executable. This iss | 0.1% | — |
| CVE-2026-25265 | HIGH 8.8 | qualcomm software_center Privilege escalation due to weak configuration while temporary file handling. | 0.1% | — |
| CVE-2026-25264 | HIGH 8.8 | qualcomm software_center Privilege escalation due to weak configuration during package extraction process. | 0.1% | — |
| CVE-2026-0295 | HIGH 7.0 | paloaltonetworks globalprotect A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected. | 0.1% | — |
| CVE-2026-24413 | MED 5.5 | icinga icinga Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its cont | 0.1% | — |
| CVE-2025-10227 | MED 4.6 | axxonsoft axxon_one Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive dat | 0.1% | — |
| CVE-2026-23153 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list of transaction is enumerated without acquiring card lock when processing AR response event. This causes a race condition | 0.1% | — |
| CVE-2026-23115 | MED 4.7 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: serial: Fix not set tty->port race condition Revert commit bfc467db60b7 ("serial: remove redundant tty_port_link_device()") because the tty_port_link_device() is not redundant: the tty->port | 0.1% | — |
| CVE-2026-11115 | HIGH 7.3 | google chrome Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium) | 0.1% | — |
| CVE-2025-58743 | HIGH 7.5 | milner imagedirector_capture Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows allows Encryption Brute Forcing to obtain database credentials.This issue affects ImageDirector Captur | 0.1% | — |
| CVE-2026-11276 | MED 5.1 | google chrome Inappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass discretionary access control via malicious network traffic. (Chromium security severity: Low) | 0.1% | — |
| CVE-2026-11103 | HIGH 7.8 | google chrome Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium) | 0.1% | — |
| CVE-2026-91812 | HIGH 7.9 | foxit pdf_editor A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges. | 0.1% | — |
| CVE-2025-46774 | HIGH 7.5 | fortinet forticlient An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executable | 0.1% | — |
| CVE-2026-53231 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: phy: don't try to setup PHY-driven SFP cages when using genphy We don't have support for PHY-driver SFP cages with the genphy code. On top of that, it was found by sashiko that running | 0.1% | — |
| CVE-2025-12439 | MED 5.5 | google chrome Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium) | 0.1% | — |
| CVE-2026-40058 | HIGH 8.8 | CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through th | 0.1% | — |
| CVE-2025-55717 | MED 4.0 | fortinet fortimail A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiR | 0.1% | — |
| CVE-2026-91795 | HIGH 7.8 | foxit pdf_editor Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially en | 0.1% | — |
| CVE-2026-64158 | HIGH 7.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfs: Fix write streaming disablement if fd open O_RDWR In netfs_perform_write(), "write streaming" (the caching of dirty data in dirty but !uptodate folios) is performed to avoid the need | 0.1% | — |
| CVE-2026-23217 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceable, echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter may get the kernel into a d | 0.1% | — |
| CVE-2026-23165 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: sfc: fix deadlock in RSS config read Since cited commit, core locks the net_device's rss_lock when handling ethtool -x command, so driver's implementation should not lock it again. Remove | 0.1% | — |
| CVE-2026-23130 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dead lock while flushing management frames Commit [1] converted the management transmission work item into a wiphy work. Since a wiphy work can only run under wiphy lock pr | 0.1% | — |
| CVE-2026-11281 | MED 5.0 | google chrome Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted ETW event. (Chromium security severity: Low) | 0.1% | — |
| CVE-2026-0392 | ND | eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS cer | 0.1% | — |