58.848 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.848 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-22740 | MED 6.5 | vmware spring_framework A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk sp | 0.3% | — |
| CVE-2026-22573 | MED 6.5 | fortinet fortisoar An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5 all versions, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-prem | 0.4% | — |
| CVE-2026-22155 | MED 6.5 | fortinet fortisoar A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, Fort | 0.2% | — |
| CVE-2026-21921 | MED 6.5 | juniper junos A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker authenticated with low privileges to cause a Denial-of-Service (DoS). When telemetry collectors are frequently su | 0.4% | — |
| CVE-2026-21919 | MED 6.5 | juniper junos An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service (DoS) of the management plane. When NETCONF s | 0.2% | — |
| CVE-2026-21911 | MED 6.5 | juniper junos_os_evolved An Incorrect Calculation vulnerability in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker flapping the management interface to cause the learning of new MACs over label-sw | 0.2% | — |
| CVE-2026-21910 | MED 6.5 | juniper junos An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX4k Series and QFX5k Series platforms allows an unauthenticated network-adjacent attacker flapping an interface to caus | 0.3% | — |
| CVE-2026-21909 | MED 6.5 | juniper junos A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker controlling an adjacent IS-IS neighbor to send a specific update packet ca | 0.3% | — |
| CVE-2026-21903 | MED 6.5 | juniper junos A Stack-based Buffer Overflow vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a network-based attacker, authenticated with low privileges to cause a Denial-of-Service (DoS). Subscribing to telemetry sensors at scale c | 0.4% | — |
| CVE-2026-21528 | MED 6.5 | microsoft azure_iot_explorer Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. | 0.5% | — |
| CVE-2026-21527 | MED 6.5 | microsoft exchange_server User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 8.1% | — |
| CVE-2026-21512 | MED 6.5 | microsoft azure_devops_server Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network. | 1.0% | — |
| CVE-2026-20925 | MED 6.5 | microsoft windows_10_1607 External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | 18.2% | — |
| CVE-2026-20872 | MED 6.5 | microsoft windows_10_1607 External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | 20.1% | — |
| CVE-2026-20847 | MED 6.5 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network. | 1.4% | — |
| CVE-2026-20812 | MED 6.5 | microsoft windows_10_1607 Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network. | 1.1% | — |
| CVE-2026-20288 | MED 6.5 | cisco unified_computing_system A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.&n | 0.6% | — |
| CVE-2026-20287 | MED 6.5 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review | 0.2% | — |
| CVE-2026-20283 | MED 6.5 | A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in I | 0.4% | — |
| CVE-2026-20262 | MED 6.5 | cisco catalyst_sd-wan_manager A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affe | 28.2% | |
| CVE-2026-20168 | MED 6.5 | cisco iot_field_network_director A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access. This vulnerability is due to insufficie | 0.3% | — |
| CVE-2026-20133 | MED 6.5 | cisco catalyst_sd-wan_manager A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmi | 31.8% | |
| CVE-2026-20097 | MED 6.5 | cisco unified_computing_system A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied inpu | 0.4% | — |
| CVE-2026-20096 | MED 6.5 | cisco enterprise_nfv_infrastructure_software A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. Thi | 0.7% | — |
| CVE-2026-20095 | MED 6.5 | cisco enterprise_nfv_infrastructure_software A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. Thi | 0.9% | — |