58.701 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.701 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-33582 | MED 6.5 | apache answer Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the | 0.7% | — |
| CVE-2026-33523 | MED 6.5 | apache http_server HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue. | 0.4% | — |
| CVE-2026-32682 | MED 6.5 | f5 nginx_gateway_fabric When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations co | 0.5% | — |
| CVE-2026-32588 | MED 6.5 | apache cassandra Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue. | 0.7% | — |
| CVE-2026-32201 | MED 6.5 | microsoft sharepoint_server Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 43.4% | |
| CVE-2026-32151 | MED 6.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-31380 | MED 6.5 | apache ofbiz Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, whic | 0.6% | — |
| CVE-2026-31378 | MED 6.5 | apache ofbiz Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. | 0.7% | — |
| CVE-2026-29220 | MED 6.5 | apache ofbiz Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. | 0.8% | — |
| CVE-2026-29207 | MED 6.5 | apache ofbiz Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updat | 0.6% | — |
| CVE-2026-28715 | MED 6.5 | acronis cyber_protect Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | 0.4% | — |
| CVE-2026-27925 | MED 6.5 | microsoft windows_10_1607 Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to disclose information over an adjacent network. | 0.5% | — |
| CVE-2026-26929 | MED 6.5 | apache airflow Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not a | 0.6% | — |
| CVE-2026-26155 | MED 6.5 | microsoft windows_10_1607 Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability | 1.0% | — |
| CVE-2026-26136 | MED 6.5 | microsoft copilot Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2026-26122 | MED 6.5 | microsoft aci_confidential_containers Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-26120 | MED 6.5 | microsoft bing Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network. | 0.8% | — |
| CVE-2026-26057 | MED 6.5 | cisco skill_scanner Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server | 0.4% | — |
| CVE-2026-25689 | MED 6.5 | fortinet fortideceptor An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, | 0.6% | — |
| CVE-2026-25219 | MED 6.5 | apache airflow The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, tho | 0.6% | — |
| CVE-2026-24888 | MED 6.5 | microsoft maker.js Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to | 1.0% | — |
| CVE-2026-24687 | MED 6.5 | umbraco umbraco_forms Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco install | 0.5% | — |
| CVE-2026-24297 | MED 6.5 | microsoft windows_10_1607 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a security feature over a network. | 0.4% | — |
| CVE-2026-24204 | MED 6.5 | nvidia nvflare NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. A successful exploit of this vulnerability may lead to information disclosure. | 0.4% | — |
| CVE-2026-24098 | MED 6.5 | apache airflow Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later | 0.8% | — |