58.414 CVE tracked
792 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.414 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted descending |
|---|---|---|---|---|
| CVE-2021-26861 | HIGH 7.8 | microsoft windows_10 Windows Graphics Component Remote Code Execution Vulnerability | 2.7% | — |
| CVE-2021-26860 | HIGH 7.8 | microsoft windows_10 Windows App-V Overlay Filter Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2021-26859 | HIGH 7.7 | microsoft power_bi_report_server Microsoft Power BI Information Disclosure Vulnerability | 3.0% | — |
| CVE-2021-26854 | MED 6.6 | microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 24.7% | — |
| CVE-2021-26708 | HIGH 7.0 | linux linux_kernel A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that | 1.6% | — |
| CVE-2021-26701 | HIGH 8.1 | fedoraproject fedora .NET Core Remote Code Execution Vulnerability | 30.1% | — |
| CVE-2021-26700 | HIGH 7.8 | microsoft npm Visual Studio Code npm-script Extension Remote Code Execution Vulnerability | 6.0% | — |
| CVE-2021-26697 | MED 5.3 | apache airflow The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to | 4.6% | — |
| CVE-2021-26691 | CRIT 9.8 | apache http_server In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow | 68.3% | — |
| CVE-2021-26690 | HIGH 7.5 | apache http_server Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service | 65.3% | — |
| CVE-2021-26677 | HIGH 7.8 | arubanetworks clearpass_policy_manager A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users on a Windows platform to | 0.3% | — |
| CVE-2021-26644 | HIGH 8.8 | mangboard mangboard_wp SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is runni | 0.9% | — |
| CVE-2021-26642 | HIGH 8.8 | xpressengine xpressengine When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the | 1.2% | — |
| CVE-2021-26639 | HIGH 8.1 | wisa smart_wing_cms This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system. | 0.5% | — |
| CVE-2021-26636 | HIGH 8.8 | maxb maxboard Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalation. | 1.5% | — |
| CVE-2021-26634 | CRIT 9.8 | maxb maxboard SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulne | 1.3% | — |
| CVE-2021-26633 | HIGH 7.5 | maxb maxboard SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerabilities can be exploited by manipulating a variable with a desired value and inserting and arbitrary file. | 0.9% | — |
| CVE-2021-26630 | HIGH 7.8 | handysoft groupware Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable funct | 0.8% | — |
| CVE-2021-26629 | HIGH 8.8 | tobesoft xplatform A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..\’. | 1.6% | — |
| CVE-2021-26626 | HIGH 8.1 | tobesoft xplatform Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The pass | 1.3% | — |
| CVE-2021-26625 | HIGH 8.8 | tobesoft nexacro Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers | 0.6% | — |
| CVE-2021-26623 | HIGH 7.8 | bandisoft bandizip A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function. | 1.1% | — |
| CVE-2021-26622 | CRIT 9.6 | genians genian_nac An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC th | 3.0% | — |
| CVE-2021-26619 | HIGH 7.1 | bigfile bigfileagent An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitrary files of unspecified number of users. | 0.9% | — |
| CVE-2021-26618 | HIGH 7.1 | tmax tooffice An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code. | 1.0% | — |