59.497 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.497 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2026-66808 | HIGH 8.8 | microsoft sharepoint_server Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 2,0% | — |
| CVE-2026-66807 | HIGH 7.8 | microsoft 365_apps Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 0,5% | — |
| CVE-2026-66806 | MED 5.5 | microsoft 365_apps Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 0,4% | — |
| CVE-2026-66805 | HIGH 8.8 | microsoft sharepoint_server Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 2,0% | — |
| CVE-2026-66804 | HIGH 7.8 | microsoft windows_10_22h2 Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-66803 | CRIT 10.0 | microsoft azure_cosmos_db Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. | 0,9% | — |
| CVE-2026-66802 | HIGH 8.1 | microsoft windows_10_1809 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network. | 0,5% | — |
| CVE-2026-66800 | HIGH 8.6 | microsoft azure_data_factory Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network. | 1,0% | — |
| CVE-2026-66799 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-66798 | MED 4.3 | microsoft edge_chromium Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-66797 | MED 5.4 | apache cloudstack Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result corr | 0,5% | — |
| CVE-2026-66756 | CRIT 9.8 | apache tika Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue. | 0,7% | — |
| CVE-2026-66755 | HIGH 7.5 | apache tika Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible | 0,6% | — |
| CVE-2026-66722 | HIGH 7.2 | apache cloudstack Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just th | 0,6% | — |
| CVE-2026-66721 | LOW 2.7 | apache cloudstack Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. | 0,5% | — |
| CVE-2026-66713 | CRIT 9.8 | apache axis2\/java Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthentic | 1,7% | — |
| CVE-2026-66422 | HIGH 8.1 | apache tomcat Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0. | 0,4% | — |
| CVE-2026-66391 | MED 6.5 | apache wicket Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the is | 0,6% | — |
| CVE-2026-66390 | MED 6.1 | apache wicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, | 0,6% | — |
| CVE-2026-66362 | HIGH 8.1 | Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom R | 0,6% | — |
| CVE-2026-66326 | MED 6.5 | microsoft edge_chromium Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-66325 | MED 6.1 | microsoft edge_chromium Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0,4% | — |
| CVE-2026-66324 | MED 6.5 | microsoft edge_chromium External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0,9% | — |
| CVE-2026-66323 | MED 5.4 | microsoft edge_chromium Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 0,4% | — |
| CVE-2026-66322 | HIGH 7.1 | microsoft edge_chromium Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0,2% | — |