60.304 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.304 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2017-7836 | HIGH 7.8 | mozilla firefox The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for privilege escalation as the replaced libcurl code will run with Firefox's privileges. Note: This attack r | 0,3% | — |
| CVE-2015-0833 | MED 6.9 | mozilla firefox Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan hors | 0,3% | — |
| CVE-2012-4112 | MED 6.8 | cisco unified_computing_system The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary commands via crafted command parameters within the command-line interface, aka Bug ID CSCtr43330. | 0,3% | — |
| CVE-2011-4160 | LOW 3.2 | hp operations_agent Unspecified vulnerability in HP Operations Agent 11.00 and Performance Agent 4.73 and 5.0 on AIX, HP-UX, Linux, and Solaris allows local users to bypass intended directory-access restrictions via unknown vectors. | 0,3% | — |
| CVE-2010-2157 | LOW 2.1 | Unspecified vulnerability in CA ARCserve Backup r11.5 SP4, r12.0 SP2, and r12.5 SP1 on Windows allows local users to obtain sensitive information via unknown vectors. | 0,3% | — |
| CVE-2026-96914 | HIGH 8.8 | microsoft windows_10_1607 Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-88093 | HIGH 7.8 | microsoft windows_10_1809 Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-83845 | HIGH 8.4 | microsoft windows_10_21h2 Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally. | 0,3% | — |
| CVE-2026-83787 | MED 5.5 | microsoft windows_10_1607 Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. | 0,3% | — |
| CVE-2026-83715 | HIGH 7.1 | microsoft windows_10_1607 Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally. | 0,3% | — |
| CVE-2026-70235 | MED 5.5 | microsoft windows_11_24h2 Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally. | 0,3% | — |
| CVE-2026-70057 | MED 5.5 | microsoft windows_10_1607 Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally. | 0,3% | — |
| CVE-2026-64235 | HIGH 8.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform (eg: Skylake), with retbleed=stuff, registe | 0,3% | — |
| CVE-2026-63649 | ND | The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitel | 0,3% | — |
| CVE-2026-59286 | HIGH 8.1 | vmware spring_for_graphql The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Sp | 0,3% | — |
| CVE-2026-54665 | MED 5.3 | apache nifi Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application pro | 0,3% | — |
| CVE-2026-47861 | MED 6.3 | vmware spring_integration An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integrat | 0,3% | — |
| CVE-2026-40048 | HIGH 7.8 | apache camel The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.K | 0,3% | — |
| CVE-2026-3543 | HIGH 8.8 | google chrome Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-20003 | MED 4.9 | cisco secure_firewall_management_center A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could e | 0,3% | — |
| CVE-2026-105009 | HIGH 7.5 | microsoft windows_server_2012 Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2025-69270 | CRIT 9.8 | broadcom dx_netops_spectrum Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue affects DX NetOps Spectrum: 24.3.8 and earlier. | 0,3% | — |
| CVE-2025-52953 | MED 6.5 | juniper junos An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a valid BGP UPDATE packet to cause a BGP session reset, resulting in a Denia | 0,3% | — |
| CVE-2025-30310 | HIGH 7.8 | adobe dreamweaver Dreamweaver Desktop versions 21.4 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires u | 0,3% | — |
| CVE-2024-50001 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix error path in multi-packet WQE transmit Remove the erroneous unmap in case no DMA mapping was established The multi-packet WQE transmit code attempts to obtain a DMA mapping f | 0,3% | — |