59.529 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.529 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2026-47885 | HIGH 7.5 | vmware spring_framework The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 | 0,4% | — |
| CVE-2026-22733 | HIGH 8.2 | vmware spring_boot Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Sec | 0,4% | — |
| CVE-2026-20916 | HIGH 8.1 | f5 big-iq_centralized_management An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0,4% | — |
| CVE-2025-64673 | HIGH 7.8 | microsoft windows_10_1809 Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2025-62474 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2025-59213 | HIGH 8.8 | microsoft configuration_manager_2403 Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network. | 0,4% | — |
| CVE-2025-55316 | HIGH 7.8 | microsoft azure_connected_machine_agent External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2025-52455 | MED 5.3 | tableau tableau_server Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. | 0,4% | — |
| CVE-2025-47967 | MED 4.7 | microsoft edge Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. | 0,4% | — |
| CVE-2025-3936 | MED 6.5 | tridium niagara Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Fram | 0,4% | — |
| CVE-2025-21720 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: xfrm: delete intermediate secpath entry in packet offload mode Packets handled by hardware have added secpath as a way to inform XFRM core code that this path was already handled. That secpa | 0,4% | — |
| CVE-2024-5908 | HIGH 7.5 | paloaltonetworks globalprotect A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when gen | 0,4% | — |
| CVE-2024-49060 | HIGH 8.8 | microsoft azure_stack_hci Azure Stack HCI Elevation of Privilege Vulnerability | 0,4% | — |
| CVE-2024-39554 | MED 5.9 | juniper junos A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attack | 0,4% | — |
| CVE-2024-30275 | HIGH 7.8 | adobe aero Adobe Aero Desktop versions 23.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mali | 0,4% | — |
| CVE-2024-20363 | MED 5.8 | cisco secure_firewall_threat_defense Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on an affected system. This vulnerability is due to incorrect | 0,4% | — |
| CVE-2023-28972 | MED 6.8 | juniper junos An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. When "set system ports console insecure" is enabled, root login is disallowed f | 0,4% | — |
| CVE-2023-1187 | LOW 3.3 | fabulatech webcam_for_remote_desktop A vulnerability was found in FabulaTech Webcam for Remote Desktop 2.8.42 and classified as problematic. This issue affects some unknown processing in the library ftwebcam.sys of the component Global Variable Handler. The manipulation leads to denial of service | 0,4% | — |
| CVE-2022-38410 | MED 5.5 | adobe illustrator Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Expl | 0,4% | — |
| CVE-2022-38409 | MED 5.5 | adobe illustrator Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Expl | 0,4% | — |
| CVE-2022-1882 | HIGH 7.8 | linux linux_kernel A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate t | 0,4% | — |
| CVE-2021-3506 | HIGH 7.1 | debian debian_linux An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a lea | 0,4% | — |
| CVE-2021-34726 | MED 6.7 | cisco sd-wan A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system of an affected device. This vulnerability is due to insuf | 0,4% | — |
| CVE-2021-29647 | MED 5.5 | debian debian_linux An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624. | 0,4% | — |
| CVE-2020-25639 | MED 4.4 | fedoraproject fedora A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system. | 0,4% | — |