58.899 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.899 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-0111 | MED 6.5 | paloaltonetworks pan-os An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can gre | 2.0% | |
| CVE-2024-9466 | MED 6.5 | paloaltonetworks expedition A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials. | 13.6% | — |
| CVE-2024-9464 | MED 6.5 | paloaltonetworks expedition An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of | 82.6% | — |
| CVE-2024-6972 | MED 6.5 | octopus octopus_server In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. | 0.2% | — |
| CVE-2024-5919 | MED 6.5 | paloaltonetworks pan-os A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the fi | 0.3% | — |
| CVE-2024-5692 | MED 6.5 | mozilla firefox On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows opera | 0.6% | — |
| CVE-2024-56736 | MED 6.5 | apache hertzbeat Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue. | 0.7% | — |
| CVE-2024-55910 | MED 6.5 | ibm concert IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | 0.2% | — |
| CVE-2024-55909 | MED 6.5 | ibm concert IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlling resource consumption. | 0.4% | — |
| CVE-2024-55633 | MED 6.5 | apache superset Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres an | 2.8% | — |
| CVE-2024-54169 | MED 6.5 | ibm entirex IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | 0.5% | — |
| CVE-2024-54021 | MED 6.5 | fortinet fortios An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via c | 0.8% | — |
| CVE-2024-53949 | MED 6.5 | apache superset Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to | 0.7% | — |
| CVE-2024-53299 | MED 6.5 | apache wicket The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue. | 1.5% | — |
| CVE-2024-52363 | MED 6.5 | ibm infosphere_information_server IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | 0.6% | — |
| CVE-2024-52317 | MED 6.5 | apache tomcat Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 throu | 2.1% | — |
| CVE-2024-52056 | MED 6.5 | wowza streaming_engine Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the target directory contains an XML definition file. | 0.7% | — |
| CVE-2024-50076 | MED 6.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in con_font_get() font.data may not initialize all memory spaces depending on the implementation of vc->vc_sw->con_font_get. This may cause info-leak, so to preve | 0.6% | — |
| CVE-2024-49823 | MED 6.5 | ibm common_cryptographic_architecture IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an authenticated user to cause a denial of service in the Hardware Security Module (HSM) using a specially crafted sequence of valid requests. | 0.4% | — |
| CVE-2024-49071 | MED 6.5 | microsoft defender_for_endpoint Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network. | 1.1% | — |
| CVE-2024-49064 | MED 6.5 | microsoft sharepoint_server Microsoft SharePoint Information Disclosure Vulnerability | 2.5% | — |
| CVE-2024-49062 | MED 6.5 | microsoft sharepoint_server Microsoft SharePoint Information Disclosure Vulnerability | 3.2% | — |
| CVE-2024-48944 | MED 6.5 | apache kylin Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The atta | 0.6% | — |
| CVE-2024-47693 | MED 6.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix ib_cache_setup_one error flow cleanup When ib_cache_update return an error, we exit ib_cache_setup_one instantly with no proper cleanup, even though before this we had already s | 1.0% | — |
| CVE-2024-47692 | MED 6.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nfsd: return -EINVAL when namelen is 0 When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdup_user() to return ZERO_SIZE_PTR | 1.2% | — |