56.568 CVE tracked
773 Exploited now
181 Used by ransomware
Last sync
CVE Tracker
56.568 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted descending |
|---|---|---|---|---|
| CVE-2023-36033 | HIGH 7.8 | microsoft windows_10_1809 Windows DWM Core Library Elevation of Privilege Vulnerability | 12.0% | |
| CVE-2023-36025 | HIGH 8.8 | microsoft windows_10_1507 Windows SmartScreen Security Feature Bypass Vulnerability | 88.2% | |
| CVE-2023-36851 | MED 5.3 | juniper junos A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.ph | 1.1% | |
| CVE-2023-36847 | MED 5.3 | juniper junos A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php | 84.6% | |
| CVE-2023-36846 | MED 5.3 | juniper junos A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't | 94.1% | |
| CVE-2023-36845 | CRIT 9.8 | juniper junos A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attac | 93.5% | |
| CVE-2023-36844 | MED 5.3 | juniper junos A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify | 91.4% | |
| CVE-2023-29552 | HIGH 7.5 | netapp smi-s_provider The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor. | 65.9% | |
| CVE-2023-46604 | CRIT 10.0 | ransomware apache activemq The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized clas | 99.7% | |
| CVE-2023-46748 | HIGH 8.8 | f5 big-ip_access_policy_manager An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrar | 4.5% | |
| CVE-2023-46747 | CRIT 9.8 | ransomware f5 big-ip_access_policy_manager Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have r | 96.5% | |
| CVE-2023-20273 | HIGH 7.2 | cisco ios_xe A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit | 89.6% | |
| CVE-2023-4966 | CRIT 9.4 | ransomware citrix netscaler_application_delivery_controller Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. | 100.0% | |
| CVE-2023-20198 | CRIT 10.0 | cisco ios_xe Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors e | 99.6% | |
| CVE-2023-44487 | HIGH 7.5 | akka http_server The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. | 100.0% | |
| CVE-2023-41763 | MED 5.3 | microsoft skype_for_business_server Skype for Business Elevation of Privilege Vulnerability | 90.4% | |
| CVE-2023-36563 | MED 6.5 | microsoft windows_10_1507 Microsoft WordPad Information Disclosure Vulnerability | 20.7% | |
| CVE-2023-21608 | HIGH 7.8 | adobe acrobat Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of | 61.5% | |
| CVE-2023-20109 | MED 6.6 | cisco ios A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitr | 2.3% | |
| CVE-2023-28229 | HIGH 7.0 | microsoft windows_10_1507 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | 1.8% | |
| CVE-2023-5217 | HIGH 8.8 | apple ipados Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 49.0% | |
| CVE-2023-41179 | HIGH 7.2 | trendmicro apex_one A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands o | 4.7% | |
| CVE-2023-26369 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of | 7.0% | |
| CVE-2023-4863 | HIGH 8.8 | bandisoft honeyview Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) | 99.7% | |
| CVE-2023-20269 | MED 5.0 | ransomware cisco adaptive_security_appliance_software A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify val | 21.6% |