60.304 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.304 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2019-1950 | HIGH 8.4 | cisco ios_xe A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected d | 0,3% | — |
| CVE-2019-17009 | HIGH 7.8 | mozilla firefox When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system acces | 0,3% | — |
| CVE-2018-0368 | HIGH 7.8 | cisco application_policy_infrastructure_controller_enterprise_module A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive information on an affected system. The vulnerability is due to insufficient security restrictions imposed by the affected softwa | 0,3% | — |
| CVE-2017-3801 | HIGH 8.8 | cisco unified_computing_system_director A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to imp | 0,3% | — |
| CVE-2017-0349 | HIGH 7.8 | nvidia gpu_driver All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is not correctly validated before it is dereferenced for a write op | 0,3% | — |
| CVE-2013-2891 | MED 4.7 | linux linux_kernel drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a craf | 0,3% | — |
| CVE-2012-4948 | MED 5.3 | fortinet fortigate-1000c The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by lever | 0,3% | — |
| CVE-2012-2284 | LOW 2.1 | emc networker_module_for_microsoft_applications The (1) install and (2) upgrade processes in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375, when Exchange Server is used, allow local users to read cleartext administrator credentials via unspecifie | 0,3% | — |
| CVE-2010-1139 | HIGH 7.2 | vmware fusion Format string vulnerability in vmrun in VMware VIX API 1.6.x, VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Linux, and VMware Fusion 2.x before 2.0.7 build 246742, allows local users | 0,3% | — |
| CVE-2008-1246 | HIGH 7.8 | cisco pix_asa_finesse_operation_system The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the f | 0,3% | — |
| CVE-2006-5394 | LOW 2.1 | cisco secure_desktop The default configuration of Cisco Secure Desktop (CSD) has an unchecked "Disable printing" box in Secure Desktop Settings, which might allow local users to read data that was sent to a printer during another user's SSL VPN session. | 0,3% | — |
| CVE-2026-89238 | CRIT 9.1 | apache wss4j WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 | 0,3% | — |
| CVE-2026-69974 | MED 4.7 | microsoft windows_10_1809 Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. | 0,3% | — |
| CVE-2026-59276 | MED 5.9 | vmware spring_security Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject | 0,3% | — |
| CVE-2026-53357 | HIGH 8.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returnin | 0,3% | — |
| CVE-2026-41095 | HIGH 7.8 | microsoft windows_server_2012 Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-40402 | CRIT 9.3 | microsoft windows_11_23h2 Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-40359 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0,3% | — |
| CVE-2026-35415 | HIGH 7.8 | microsoft windows_10_1607 Integer overflow or wraparound in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-10898 | HIGH 8.3 | google chrome Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | 0,3% | — |
| CVE-2025-61832 | HIGH 7.8 | adobe indesign InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victi | 0,3% | — |
| CVE-2025-61824 | HIGH 7.8 | adobe indesign InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victi | 0,3% | — |
| CVE-2025-61820 | HIGH 7.8 | adobe illustrator Illustrator versions 28.7.10, 29.8.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim | 0,3% | — |
| CVE-2025-39894 | HIGH 7.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to | 0,3% | — |
| CVE-2024-39543 | MED 6.5 | juniper junos A Buffer Copy without Checking Size of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to send specific RPKI-RTR packets resulting in a cra | 0,3% | — |