60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.368 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-47075 | MED 5.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak in nvmet_alloc_ctrl() When creating ctrl in nvmet_alloc_ctrl(), if the cntlid_min is larger than cntlid_max of the subsystem, and jumps to the "out_free_changed_ns_lis | 0.9% | — |
| CVE-2021-47064 | MED 5.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mt76: fix potential DMA mapping leak With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap could potentially inherit a non-zero value from stack garbage. If this happens, | 0.8% | — |
| CVE-2021-46873 | MED 5.3 | wireguard wireguard WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one stati | 0.5% | — |
| CVE-2021-43410 | MED 5.3 | apache airavata_django_portal Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 [1] of airavata-djang | 2.5% | — |
| CVE-2021-41831 | MED 5.3 | apache openoffice It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory. | 1.5% | — |
| CVE-2021-41532 | MED 5.3 | apache ozone In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints. | 2.4% | — |
| CVE-2021-41346 | MED 5.3 | microsoft windows_10 Console Window Host Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2021-41013 | MED 5.3 | fortinet fortiweb An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs. | 1.0% | — |
| CVE-2021-40482 | MED 5.3 | microsoft sharepoint_server Microsoft SharePoint Server Information Disclosure Vulnerability | 2.3% | — |
| CVE-2021-40456 | MED 5.3 | microsoft windows_server Windows AD FS Security Feature Bypass Vulnerability | 2.3% | — |
| CVE-2021-4040 | MED 5.3 | apache artemis A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of malic | 3.2% | — |
| CVE-2021-40128 | MED 5.3 | cisco webex_meetings A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient | 1.0% | — |
| CVE-2021-40127 | MED 5.3 | cisco sf200-24_firmware A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote att | 1.3% | — |
| CVE-2021-40125 | MED 5.3 | cisco adaptive_security_appliance_software A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to trigger a denial of service (Do | 1.0% | — |
| CVE-2021-39086 | MED 5.3 | ibm sterling_file_gateway IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be | 1.0% | — |
| CVE-2021-39006 | MED 5.3 | ibm qradar_wincollect IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices. IBM X-Force ID: 213549. | 0.9% | — |
| CVE-2021-38981 | MED 5.3 | ibm security_guardium_key_lifecycle_manager IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB | 1.4% | — |
| CVE-2021-38980 | MED 5.3 | ibm security_guardium_key_lifecycle_manager IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be | 1.2% | — |
| CVE-2021-38939 | MED 5.3 | ibm qradar_security_information_and_event_manager IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037. | 0.8% | — |
| CVE-2021-38879 | MED 5.3 | ibm jazz_team_server IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from th | 1.1% | — |
| CVE-2021-36930 | MED 5.3 | microsoft edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2021-36187 | MED 5.3 | fortinet fortiweb A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests | 1.4% | — |
| CVE-2021-35936 | MED 5.3 | apache airflow If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentic | 5.5% | — |
| CVE-2021-34794 | MED 5.3 | cisco adaptive_security_appliance_software A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to q | 0.9% | — |
| CVE-2021-34787 | MED 5.3 | cisco adaptive_security_appliance A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. | 1.0% | — |