58.135 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.135 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted ascending |
|---|---|---|---|---|
| CVE-2021-24006 | MED 6.3 | fortinet fortimanager An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL. | 1.0% | — |
| CVE-2021-24005 | MED 4.0 | fortinet fortiauthenticator Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-co | 0.6% | — |
| CVE-2021-23937 | HIGH 7.5 | apache wicket A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to ov | 4.3% | — |
| CVE-2021-23926 | CRIT 9.1 | apache xmlbeans The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0. | 6.2% | — |
| CVE-2021-23901 | CRIT 9.1 | apache nutch An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere wit | 4.4% | — |
| CVE-2021-23827 | MED 5.5 | keybase keybase Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private pictures) in the Cache and uploadtemps directories. It fails to effectively clear cached pictures, ev | 0.3% | — |
| CVE-2021-23338 | MED 6.6 | microsoft qlib This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function. | 3.6% | — |
| CVE-2021-23219 | MED 4.1 | nvidia dgx-1_p100 NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to access protected information by identifying, exploiting, and loading vulnerable microcode. Such an attack may lead to info | 0.2% | — |
| CVE-2021-23217 | HIGH 7.5 | nvidia geforce_gt_605 NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may impact con | 0.3% | — |
| CVE-2021-23201 | HIGH 7.5 | nvidia geforce_gtx_950 NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with elevated privileges to generate valid microcode by identifying, exploiting, and loading vulnerable microcode. Such an attack could lead to informa | 0.3% | — |
| CVE-2021-23175 | HIGH 8.2 | nvidia geforce_experience NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information d | 0.4% | — |
| CVE-2021-23139 | HIGH 7.5 | trendmicro apex_one A null pointer vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an attacker to crash the CGI program on affected installations. | 1.1% | — |
| CVE-2021-23134 | HIGH 7.8 | debian debian_linux Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability. | 0.4% | — |
| CVE-2021-23133 | MED 6.7 | broadcom brocade_fabric_operating_system A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock t | 0.5% | — |
| CVE-2021-23055 | MED 6.5 | f5 nginx_ingress_controller On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evalua | 0.8% | — |
| CVE-2021-23054 | MED 6.1 | f5 big-ip_access_policy_manager On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop | 0.6% | — |
| CVE-2021-23053 | MED 5.3 | f5 big-ip_advanced_web_application_firewall On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL datab | 0.9% | — |
| CVE-2021-23052 | MED 6.1 | f5 big-ip_access_policy_manager On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious user to build an open redirect URI. Note: Sof | 0.6% | — |
| CVE-2021-23051 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP on Amazon Web Services (AWS) systems, undisclosed requests can cause the Traffic Management Microkernel (TMM) to ter | 1.0% | — |
| CVE-2021-23050 | HIGH 7.5 | f5 big-ip_advanced_web_application_firewall On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML res | 0.5% | — |
| CVE-2021-23049 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an ou | 1.0% | — |
| CVE-2021-23048 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when GPRS Tunneling Protocol (GTP) iRules commands or a GTP profile is configured on a virtual server, undi | 1.0% | — |
| CVE-2021-23047 | MED 5.3 | f5 big-ip_access_policy_manager On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APM performs Online Certificate Status Protocol (OCSP) verification of a certificate that contains Authority Information A | 0.6% | — |
| CVE-2021-23046 | MED 4.9 | f5 big-ip_access_policy_manager On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configuration (AGC), secure properties are logged in restnoded logs. Note: Software versions which have reache | 0.8% | — |
| CVE-2021-23045 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP profile with multiple paths is configured on a virtual server, undisclosed requests can cause the Traffic | 0.9% | — |