58.127 CVE seguite
788 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.127 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più basso | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2023-0002 | MED 5.5 | paloaltonetworks cortex_xdr_agent A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent. | 0,3% | — |
| CVE-2022-50358 | MED 4.2 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: brcmfmac: return error when getting invalid max_flowrings from dongle When firmware hit trap at initialization, host will read abnormal max_flowrings number from dongle, and it will cause ke | 0,3% | — |
| CVE-2022-49728 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in __ip6_append_data Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-in | 0,3% | — |
| CVE-2022-49533 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ath11k: Change max no of active probe SSID and BSSID to fw capability The maximum number of SSIDs in a for active probe requests is currently reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when | 0,3% | — |
| CVE-2021-47541 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and tmp->tx_cq will be freed on the error path of mlx4 | 0,3% | — |
| CVE-2021-26106 | HIGH 7.8 | fortinet fortiap An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specif | 0,3% | — |
| CVE-2019-5671 | MED 5.5 | nvidia gpu_driver NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software does not release a resource after its effective lifetime has ended, which may lead to denial of service. | 0,3% | — |
| CVE-2016-9381 | HIGH 7.5 | citrix xenserver Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability. | 0,3% | — |
| CVE-2007-4315 | MED 6.9 | amd catalyst_driver The AMD ATI atidsmxx.sys 3.0.502.0 driver on Windows Vista allows local users to bypass the driver signing policy, write to arbitrary kernel memory locations, and thereby gain privileges via unspecified vectors, as demonstrated by "Purple Pill". | 0,3% | — |
| CVE-2026-9995 | HIGH 8.8 | google chrome Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-9976 | HIGH 8.8 | google chrome Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-9138 | MED 6.5 | langflow langflow IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input | 0,3% | — |
| CVE-2026-83939 | HIGH 8.2 | microsoft windows_11_26h1 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-7899 | HIGH 8.8 | google chrome Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0,3% | — |
| CVE-2026-69278 | HIGH 7.8 | microsoft visual_studio_code Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 0,3% | — |
| CVE-2026-65081 | HIGH 8.1 | nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, inform | 0,3% | — |
| CVE-2026-59320 | MED 6.5 | vmware spring_advanced_message_queuing_protocol When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and | 0,3% | — |
| CVE-2026-58650 | HIGH 7.8 | microsoft visual_studio_code Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 0,3% | — |
| CVE-2026-50650 | HIGH 7.8 | microsoft .net Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-49230 | CRIT 9.1 | apache apisix Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass. This issue affects Apache APISIX: from 3.8.0 through 3.16.0. Users are recommended to upg | 0,3% | — |
| CVE-2026-41726 | MED 6.5 | vmware spring_for_apache_kafka When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected ve | 0,3% | — |
| CVE-2026-22747 | MED 6.8 | vmware spring_security Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an | 0,3% | — |
| CVE-2025-59792 | MED 5.3 | apache kvrocks Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue. | 0,3% | — |
| CVE-2025-21703 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of t | 0,3% | — |
| CVE-2024-8033 | MED 4.3 | google chrome Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malicious application to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 0,3% | — |