60.375 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.375 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2026-5276 | MED 6.5 | google chrome Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) | 0,2% | — |
| CVE-2026-43377 | HIGH 8.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and generate_smb3encryptionkey() log the session, sign | 0,2% | — |
| CVE-2026-42924 | HIGH 8.7 | f5 big-ip_access_policy_manager An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not e | 0,2% | — |
| CVE-2026-41953 | HIGH 8.7 | f5 big-ip_access_policy_manager A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation. Note: Software versions which have reached End of Tech | 0,2% | — |
| CVE-2026-40631 | HIGH 8.7 | f5 big-ip_access_policy_manager An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evalua | 0,2% | — |
| CVE-2026-40462 | MED 6.5 | f5 big-ip_access_policy_manager Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS | 0,2% | — |
| CVE-2026-35062 | MED 6.5 | f5 big-ip_access_policy_manager An authenticated iControl SOAP user may be able to obtain information of other accounts. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0,2% | — |
| CVE-2026-23136 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of | 0,2% | — |
| CVE-2026-22753 | HIGH 7.5 | vmware spring_security Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be | 0,2% | — |
| CVE-2026-13793 | MED 6.5 | google chrome Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | 0,2% | — |
| CVE-2026-0385 | MED 5.0 | microsoft edge_chromium Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | 0,2% | — |
| CVE-2025-8881 | MED 6.5 | google chrome Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | 0,2% | — |
| CVE-2025-6759 | HIGH 7.8 | citrix virtual_apps_and_desktops Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS | 0,2% | — |
| CVE-2025-61834 | HIGH 7.8 | adobe substance_3d_stager Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a m | 0,2% | — |
| CVE-2025-61818 | HIGH 7.8 | adobe incopy InCopy versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a maliciou | 0,2% | — |
| CVE-2025-61817 | HIGH 7.8 | adobe incopy InCopy versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a maliciou | 0,2% | — |
| CVE-2025-54971 | MED 4.3 | fortinet fortiadc An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to | 0,2% | — |
| CVE-2025-37838 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_s | 0,2% | — |
| CVE-2025-32098 | MED 5.3 | samsung magician An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file delete operations during the update process. | 0,2% | — |
| CVE-2025-23135 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Teardown riscv specific bits after kvm_exit During a module removal, kvm_exit invokes arch specific disable call which disables AIA. However, we invoke aia_exit before kvm_exit | 0,2% | — |
| CVE-2025-21853 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we | 0,2% | — |
| CVE-2025-21645 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it Wakeup for IRQ1 should be disabled only in cases where i8042 had actually enabled it, otherwise "wake_depth" fo | 0,2% | — |
| CVE-2025-13721 | HIGH 7.5 | google chrome Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | 0,2% | — |
| CVE-2024-7998 | LOW 2.6 | octopus octopus_server In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan. | 0,2% | — |
| CVE-2024-57834 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread syzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1] If dvb->mux is not initialized successfully by vidtv_mux_init() in t | 0,2% | — |