59.419 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.419 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-43062 | MED 6.1 | fortinet fortimail A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or com | 12.9% | — |
| CVE-2021-42357 | MED 6.1 | apache knox When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by a | 2.6% | — |
| CVE-2021-41368 | MED 6.1 | microsoft 365_apps Microsoft Access Remote Code Execution Vulnerability | 5.0% | — |
| CVE-2021-41015 | MED 6.1 | fortinet fortiweb A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler | 0.9% | — |
| CVE-2021-40776 | MED 6.1 | adobe lightroom Adobe Lightroom Classic 10.3 (and earlier) are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before | 0.5% | — |
| CVE-2021-40369 | MED 6.1 | apache jspwiki A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. A | 3.4% | — |
| CVE-2021-40121 | MED 6.1 | cisco identity_services_engine Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabili | 0.5% | — |
| CVE-2021-40115 | MED 6.1 | cisco collaboration_meeting_rooms A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-bas | 0.8% | — |
| CVE-2021-39846 | MED 6.1 | adobe acrobat Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted PDF file, potentially resulting in memory corruption in | 2.6% | — |
| CVE-2021-39845 | MED 6.1 | adobe acrobat Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted PDF file, potentially resulting in memory corruption in | 2.6% | — |
| CVE-2021-39246 | MED 6.1 | torproject tor_browser Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to | 0.5% | — |
| CVE-2021-38896 | MED 6.1 | ibm qradar_advisor IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted | 0.7% | — |
| CVE-2021-38657 | MED 6.1 | microsoft 365_apps Microsoft Office Graphics Component Information Disclosure Vulnerability | 0.9% | — |
| CVE-2021-38642 | MED 6.1 | microsoft edge Microsoft Edge for iOS Spoofing Vulnerability | 1.2% | — |
| CVE-2021-38641 | MED 6.1 | microsoft edge Microsoft Edge for Android Spoofing Vulnerability | 1.2% | — |
| CVE-2021-36739 | MED 6.1 | apache pluto The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks. | 2.3% | — |
| CVE-2021-36738 | MED 6.1 | apache pluto The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact | 2.3% | — |
| CVE-2021-36737 | MED 6.1 | apache pluto The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact | 2.3% | — |
| CVE-2021-3641 | MED 6.1 | bitdefender gravityzone Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to cause a denial of service. This issue affects: Bitdefender GravityZone version 7.1. | 0.4% | — |
| CVE-2021-36188 | MED 6.1 | fortinet fortiweb A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and e | 0.7% | — |
| CVE-2021-36176 | MED 6.1 | fortinet fortiportal Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests. | 0.6% | — |
| CVE-2021-34742 | MED 6.1 | cisco vision_dynamic_signage_director A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerabil | 0.8% | — |
| CVE-2021-34738 | MED 6.1 | cisco identity_services_engine Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabili | 0.6% | — |
| CVE-2021-34732 | MED 6.1 | cisco prime_collaboration_provisioning A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insuffi | 0.8% | — |
| CVE-2021-34506 | MED 6.1 | microsoft edge_chromium Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 2.2% | — |