56.855 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.855 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-25922 | MED 4.3 | ibm security_guardium_key_lifecycle_manager IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621. | 0.6% | — |
| CVE-2023-25609 | MED 4.3 | fortinet fortianalyzer A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the sys | 0.4% | — |
| CVE-2023-25601 | MED 4.3 | apache dolphinscheduler On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version | 1.1% | — |
| CVE-2023-25196 | MED 4.3 | apache fineract Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract. Authorized users may be able to change or add data in certain components. This issue affects Apache Fineract: f | 1.3% | — |
| CVE-2023-24911 | MED 4.3 | microsoft windows_10_1607 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability | 1.1% | — |
| CVE-2023-23487 | MED 4.3 | ibm db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918. | 0.8% | — |
| CVE-2023-21794 | MED 4.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0.7% | — |
| CVE-2023-21729 | MED 4.3 | microsoft windows_10_1607 Remote Procedure Call Runtime Information Disclosure Vulnerability | 1.3% | — |
| CVE-2023-20237 | MED 4.3 | cisco intersight_virtual_appliance A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible. This vulnerability is due to insufficient restrictions on internally accessible http pr | 0.3% | — |
| CVE-2023-20233 | MED 4.3 | cisco ios_xr A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect processing | 0.3% | — |
| CVE-2023-20213 | MED 4.3 | cisco identity_services_engine A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of the CDP process on an affected device. This vulnerability is due to insufficient bounds checking when a | 0.3% | — |
| CVE-2023-20180 | MED 4.3 | cisco webex_meetings A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web | 0.4% | — |
| CVE-2023-20179 | MED 4.3 | cisco sd-wan_vmanage A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied da | 0.4% | — |
| CVE-2023-20136 | MED 4.3 | cisco secure_workload A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. | 0.5% | — |
| CVE-2023-20094 | MED 4.3 | cisco roomos A vulnerability in Cisco TelePresence CE and RoomOS could allow an unauthenticated, adjacent attacker to view sensitive information on an affected device. This vulnerability exists because the affected software performs improper bounds checks. An attacker c | 0.3% | — |
| CVE-2023-20059 | MED 4.3 | cisco catalyst_center A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged user credentials. Th | 0.4% | — |
| CVE-2022-44688 | MED 4.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 1.1% | — |
| CVE-2022-43954 | MED 4.3 | fortinet fortiportal An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote authenticated attacker to read other devices' passwords in the audit log page. | 0.7% | — |
| CVE-2022-43950 | MED 4.3 | fortinet fortinac A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an unauthenticated attacker to redi | 0.4% | — |
| CVE-2022-43908 | MED 4.3 | ibm security_guardium IBM Security Guardium 11.3 could allow an authenticated user to cause a denial of service due to improper input validation. IBM X-Force ID: 240903. | 0.7% | — |
| CVE-2022-43903 | MED 4.3 | ibm security_guardium IBM Security Guardium 10.6, 11.3, and 11.4 could allow an authenticated user to cause a denial of service due to due to improper input validation. IBM X-Force ID: 240894. | 0.6% | — |
| CVE-2022-42469 | MED 4.3 | fortinet fortios A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal. | 0.4% | — |
| CVE-2022-40309 | MED 4.3 | apache archiva Users with write permissions to a repository can delete arbitrary directories. | 1.4% | — |
| CVE-2022-40231 | MED 4.3 | ibm sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 could allow an authenticated user to perform unauthorized actions due to improper access controls. IBM X-Force ID: 235533. | 0.6% | — |
| CVE-2022-38380 | MED 4.3 | fortinet fortios An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API. | 23.0% | — |