58.575 CVE seguite
797 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.575 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2026-26144 | HIGH 7.5 | microsoft 365_apps Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 0,8% | — |
| CVE-2025-21211 | MED 6.8 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0,8% | — |
| CVE-2024-41007 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two ji | 0,8% | — |
| CVE-2023-38187 | MED 6.5 | microsoft edge_chromium Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 0,8% | — |
| CVE-2023-32022 | HIGH 7.6 | microsoft windows_server_2012 Windows Server Service Security Feature Bypass Vulnerability | 0,8% | — |
| CVE-2023-28866 | MED 5.3 | linux linux_kernel In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not. | 0,8% | — |
| CVE-2022-35760 | HIGH 7.8 | microsoft windows_10 Microsoft ATA Port Driver Elevation of Privilege Vulnerability | 0,8% | — |
| CVE-2022-29582 | HIGH 7.0 | debian debian_linux In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequ | 0,8% | — |
| CVE-2021-32598 | MED 4.3 | fortinet fortianalyzer An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow an authenticated and remote attac | 0,8% | — |
| CVE-2021-1599 | MED 5.4 | cisco unified_customer_voice_portal A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack against a user. This vulnerability is due to insufficient input vali | 0,8% | — |
| CVE-2020-7850 | HIGH 7.8 | douzone nbbdownloader.ocx NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing dama | 0,8% | — |
| CVE-2019-19164 | HIGH 7.8 | raonwiz dext5 dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, c | 0,8% | — |
| CVE-2018-0257 | MED 4.3 | cisco ios_xe A vulnerability in Cisco IOS XE Software running on Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, adjacent attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerabilit | 0,8% | — |
| CVE-2017-0435 | HIGH 7.0 | google android An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. | 0,8% | — |
| CVE-2016-1451 | MED 6.1 | cisco meeting_server Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Meeting Server (formerly Acano Conferencing Server) 1.7 through 1.9 allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCva1 | 0,8% | — |
| CVE-2016-1431 | MED 6.1 | cisco secure_firewall_management_center Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCur25516. | 0,8% | — |
| CVE-2016-1375 | MED 6.1 | cisco ip_interoperability_and_collaboration_system Cross-site scripting (XSS) vulnerability in Cisco IP Interoperability and Collaboration System 4.10(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy12339. | 0,8% | — |
| CVE-2016-1354 | MED 6.1 | cisco unified_communications_domain_manager Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 8.x before 8.1.1 allows remote attackers to inject arbitrary web script or HTML via crafted markup data, aka Bug ID CSCud41176. | 0,8% | — |
| CVE-2016-1300 | MED 6.1 | cisco unity_connection Cross-site scripting (XSS) vulnerability in Cisco Unity Connection (UC) 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux82582. | 0,8% | — |
| CVE-2015-4239 | MED 6.1 | cisco adaptive_security_appliance_software Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220. | 0,8% | — |
| CVE-2012-6606 | MED 5.8 | paloaltonetworks globalprotect Palo Alto Networks GlobalProtect before 1.1.7, and NetConnect, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof portal servers and obtain sensitive information via a crafted certificate. | 0,8% | — |
| CVE-2011-1424 | LOW 3.5 | emc sourceone_email_management The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the localOnly attribute of the trace element, which allows remote authenticated users to obta | 0,8% | — |
| CVE-2007-1730 | MED 6.6 | linux linux_kernel Integer signedness error in the DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service (oops) via a negative optlen value. | 0,8% | — |
| CVE-2026-58188 | HIGH 8.2 | apache traffic_server Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to | 0,8% | — |
| CVE-2026-56452 | HIGH 7.5 | apache mina_sshd Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A mali | 0,8% | — |