60.267 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
Vulnerabilità sfruttate attivamente
809 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2024-3393 | HIGH 7.5 | paloaltonetworks pan-os A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger thi | 29,1% | |
| CVE-2024-38193 | HIGH 7.8 | microsoft windows_10_1507 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | 28,7% | |
| CVE-2010-0232 | HIGH 7.8 | microsoft windows_2000 The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32 | 28,7% | |
| CVE-2020-3153 | MED 6.5 | ransomware cisco anyconnect_secure_mobility_client A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the | 28,3% | |
| CVE-2022-37969 | HIGH 7.8 | ransomware microsoft windows_10_1507 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 28,3% | |
| CVE-2026-20262 | MED 6.5 | cisco catalyst_sd-wan_manager A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affe | 28,2% | |
| CVE-2024-1086 | HIGH 7.8 | ransomware debian debian_linux A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_s | 28,1% | |
| CVE-2023-36802 | HIGH 7.8 | microsoft windows_10_1809 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | 27,9% | |
| CVE-2024-21351 | HIGH 7.6 | microsoft windows_10_1507 Windows SmartScreen Security Feature Bypass Vulnerability | 27,8% | |
| CVE-2018-8581 | HIGH 7.4 | ransomware microsoft exchange_server An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server. | 27,4% | |
| CVE-2025-30397 | HIGH 7.5 | microsoft windows_10_1507 Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network. | 27,3% | |
| CVE-2024-37085 | MED 6.8 | ransomware vmware cloud_foundation VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere | 26,8% | |
| CVE-2016-3351 | MED 6.5 | ransomware microsoft edge Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." | 26,5% | |
| CVE-2014-2817 | HIGH 8.8 | microsoft internet_explorer Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." | 26,3% | |
| CVE-2020-8196 | MED 4.3 | citrix application_delivery_controller_firmware Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privil | 26,3% | |
| CVE-2024-49138 | HIGH 7.8 | microsoft windows_10_1507 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 26,2% | |
| CVE-2026-20122 | MED 5.4 | cisco catalyst_sd-wan_manager A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access o | 25,8% | |
| CVE-2023-20269 | MED 5.0 | ransomware cisco adaptive_security_appliance_software A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify val | 25,5% | |
| CVE-2026-20245 | HIGH 7.8 | cisco catalyst_sd-wan_manager A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute | 25,3% | |
| CVE-2024-35250 | HIGH 7.8 | microsoft windows_10_1507 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | 25,2% | |
| CVE-2016-7855 | HIGH 8.8 | adobe flash_player Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016. | 25,2% | |
| CVE-2022-0185 | HIGH 8.4 | linux linux_kernel A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherw | 25,2% | |
| CVE-2019-18187 | HIGH 7.5 | trendmicro officescan Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote | 25,1% | |
| CVE-2018-5002 | HIGH 7.8 | adobe flash_player Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. | 25,1% | |
| CVE-2026-94127 | CRIT 9.8 | f5 big-ip_access_policy_manager When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Depl | 24,9% |