57.023 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
57.023 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-20192 | CRIT 9.6 | cisco telepresence_video_communication_server Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write creden | 0.7% | — |
| CVE-2023-20105 | CRIT 9.6 | cisco telepresence_video_communication_server A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with Read-only credentials to elevate privileges to Administrator on an affect | 0.9% | — |
| CVE-2022-41924 | CRIT 9.6 | tailscale tailscale A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP soc | 1.6% | — |
| CVE-2022-4135 | CRIT 9.6 | google chrome Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 31.9% | |
| CVE-2022-4126 | CRIT 9.6 | abb rccmd Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207. | 0.6% | — |
| CVE-2022-33649 | CRIT 9.6 | microsoft edge_chromium Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 2.3% | — |
| CVE-2022-20658 | CRIT 9.6 | cisco unified_contact_center_express A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate their privileges to A | 1.4% | — |
| CVE-2021-43905 | CRIT 9.6 | microsoft 365_copilot Microsoft Office app Remote Code Execution Vulnerability | 2.8% | — |
| CVE-2021-26622 | CRIT 9.6 | genians genian_nac An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC th | 3.0% | — |
| CVE-2021-23037 | CRIT 9.6 | f5 big-ip_access_policy_manager On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context o | 0.8% | — |
| CVE-2021-21155 | CRIT 9.6 | fedoraproject fedora Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 1.3% | — |
| CVE-2021-21150 | CRIT 9.6 | fedoraproject fedora Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 1.2% | — |
| CVE-2021-21132 | CRIT 9.6 | google chrome Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension. | 23.4% | — |
| CVE-2021-21124 | CRIT 9.6 | google chrome Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | 7.9% | — |
| CVE-2021-21121 | CRIT 9.6 | google chrome Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | 6.2% | — |
| CVE-2021-21107 | CRIT 9.6 | debian debian_linux Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 1.1% | — |
| CVE-2021-1264 | CRIT 9.6 | cisco catalyst_center A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit | 3.7% | — |
| CVE-2020-7868 | CRIT 9.6 | helpu helpu A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used for login. | 2.7% | — |
| CVE-2020-5948 | CRIT 9.6 | f5 big-ip_access_policy_manager On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system | 1.0% | — |
| CVE-2020-5901 | CRIT 9.6 | f5 nginx_controller In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system. | 1.5% | — |
| CVE-2020-16011 | CRIT 9.6 | debian debian_linux Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 2.4% | — |
| CVE-2020-0872 | CRIT 9.6 | microsoft application_inspector A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output, aka 'Remote Code Execution Vulnerability in Application Inspector' | 10.1% | — |
| CVE-2019-5521 | CRIT 9.6 | vmware esxi VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6) and Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain an out-of-bounds read vulnerability in the pixel shader funct | 1.6% | — |
| CVE-2019-20374 | CRIT 9.6 | typora typora A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is th | 2.3% | — |
| CVE-2018-0264 | CRIT 9.6 | cisco webex_business_suite_31 A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execute arbitrary code on the system of a targeted user. An attacker could exploit this vulnerability by se | 3.3% | — |