58.352 CVE seguite
790 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.352 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più basso | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2026-23665 | HIGH 7.8 | microsoft linux_diagnostic_extension Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2026-23364 | HIGH 7.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq(). | 0,4% | — |
| CVE-2026-0250 | HIGH 8.1 | paloaltonetworks globalprotect A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the | 0,4% | — |
| CVE-2025-49552 | HIGH 8.1 | adobe connect Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a high-privileged attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user inte | 0,4% | — |
| CVE-2025-47148 | MED 6.5 | f5 big-ip_access_policy_manager When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource util | 0,4% | — |
| CVE-2025-21262 | MED 5.4 | microsoft edge_chromium User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network | 0,4% | — |
| CVE-2024-50565 | LOW 3.1 | fortinet fortianalyzer A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version | 0,4% | — |
| CVE-2024-12751 | HIGH 7.8 | foxit pdf_editor Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in | 0,4% | — |
| CVE-2023-32162 | HIGH 7.8 | wacom driver Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the abili | 0,4% | — |
| CVE-2022-50373 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix race in lowcomms This patch fixes a race between queue_work() in _dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can take the final reference of a dlm_msg an | 0,4% | — |
| CVE-2022-43952 | LOW 3.5 | fortinet fortiadc An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 and below, version 7.0.3 and below, version 6.2.5 and below may allow an authenticated attacker to perform a cross-site scr | 0,4% | — |
| CVE-2022-41950 | MED 6.4 | super_xray_project super_xray super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurate default xray permissions. Note: this vulnerability only affects Linux and Mac OS systems. Users sho | 0,4% | — |
| CVE-2022-38027 | HIGH 7.0 | microsoft windows_10 Windows Storage Elevation of Privilege Vulnerability | 0,4% | — |
| CVE-2022-38021 | HIGH 7.0 | microsoft windows_10 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability | 0,4% | — |
| CVE-2022-34330 | MED 6.1 | ibm sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent | 0,4% | — |
| CVE-2021-42954 | HIGH 7.8 | zohocorp manageengine_remote_access_plus Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group (non-admin or any g | 0,4% | — |
| CVE-2021-36189 | MED 6.8 | fortinet forticlient_enterprise_management_server A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allows attacker to information disclosure via inspecting browser decrypted data | 0,4% | — |
| CVE-2020-12768 | MED 5.5 | canonical ubuntu_linux An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because it's a one-time leak at the boot, the size is negligible, and it can't be trigg | 0,4% | — |
| CVE-2019-1677 | MED 4.6 | cisco webex_meetings A vulnerability in Cisco Webex Meetings for Android could allow an unauthenticated, local attacker to perform a cross-site scripting attack against the application. The vulnerability is due to insufficient validation of the application input parameters. An att | 0,4% | — |
| CVE-2019-1654 | HIGH 7.8 | cisco ap-cos A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could allow an authenticated, local attacker to access the development shell without proper authentication | 0,4% | — |
| CVE-2018-0352 | MED 6.7 | cisco wide_area_application_services A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user | 0,4% | — |
| CVE-2016-7097 | MED 4.4 | linux linux_kernel The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. | 0,4% | — |
| CVE-2016-6369 | HIGH 7.8 | cisco anyconnect_secure_mobility_client Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464. | 0,4% | — |
| CVE-2015-6370 | HIGH 7.2 | cisco firepower_extensible_operating_system The Management I/O (MIO) component in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows local users to execute arbitrary OS commands as root via crafted CLI input, aka Bug ID CSCux10578. | 0,4% | — |
| CVE-2011-2521 | MED 4.9 | linux linux_kernel The x86_assign_hw_event function in arch/x86/kernel/cpu/perf_event.c in the Performance Events subsystem in the Linux kernel before 2.6.39 does not properly calculate counter values, which allows local users to cause a denial of service (panic) via the perf pr | 0,4% | — |