60.361 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.361 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-98097 | MED 5.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer. Replace the strcpy(data, l->if_name) with memcpy() so th | 0.2% | — |
| CVE-2026-92415 | MED 5.3 | apache jackrabbit — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes fr | 0.5% | — |
| CVE-2026-91814 | MED 5.3 | foxit pdf_editor A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially | 0.2% | — |
| CVE-2026-9124 | MED 5.3 | google chrome Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2026-85939 | MED 5.3 | microsoft windows_10_1607 Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. | 0.4% | — |
| CVE-2026-8546 | MED 5.3 | google chrome Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security | 0.2% | — |
| CVE-2026-8541 | MED 5.3 | google chrome Out of bounds read in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-8535 | MED 5.3 | google chrome Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted JPEG file. (Chromium sec | 0.2% | — |
| CVE-2026-85315 | MED 5.3 | apache camel Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's messa | 0.3% | — |
| CVE-2026-85257 | MED 5.3 | apache camel Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception t | 0.4% | — |
| CVE-2026-85246 | MED 5.3 | apache camel Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer wrote ex | 0.4% | — |
| CVE-2026-8516 | MED 5.3 | google chrome Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted H | 0.2% | — |
| CVE-2026-84501 | MED 5.3 | apache zookeeper An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvi | 0.7% | — |
| CVE-2026-84439 | MED 5.3 | apache zookeeper When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the aud | 0.7% | — |
| CVE-2026-84329 | MED 5.3 | google chrome Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | 0.3% | — |
| CVE-2026-84180 | MED 5.3 | apache camel Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, th | 0.4% | — |
| CVE-2026-81380 | MED 5.3 | microsoft visual_studio_code Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 0.7% | — |
| CVE-2026-79768 | MED 5.3 | apache http_server Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue | 0.5% | — |
| CVE-2026-7960 | MED 5.3 | google chrome Race in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-7955 | MED 5.3 | google chrome Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2026-76447 | MED 5.3 | cisco identity_services_engine A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerabilit | 0.4% | — |
| CVE-2026-76444 | MED 5.3 | cisco identity_services_engine A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy | 0.4% | — |
| CVE-2026-76439 | MED 5.3 | cisco identity_services_engine A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline. This vulnerabi | 0.4% | — |
| CVE-2026-76433 | MED 5.3 | cisco identity_services_engine A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device. This vulnerability is due to insufficient validation of directory tra | 1.3% | — |
| CVE-2026-76390 | MED 5.3 | cisco talos_intelligence_for_enterprise_security_cloud In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on R | 0.4% | — |