57.056 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
57.056 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sorted descending |
|---|---|---|---|---|
| CVE-2024-9965 | HIGH 8.8 | google chrome Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) | 0.5% | — |
| CVE-2024-9950 | HIGH 7.8 | forescout secureconnector A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory. | 0.3% | — |
| CVE-2024-9949 | MED 6.1 | forescout secureconnector Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service in the application. | 0.1% | — |
| CVE-2024-9842 | HIGH 7.3 | ivanti secure_access_client Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders. | 0.2% | — |
| CVE-2024-9827 | HIGH 7.8 | autodesk autocad A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the cont | 0.2% | — |
| CVE-2024-9826 | HIGH 7.8 | autodesk autocad A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of t | 0.2% | — |
| CVE-2024-9473 | HIGH 7.8 | paloaltonetworks globalprotect A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered b | 0.3% | — |
| CVE-2024-9471 | MED 4.7 | paloaltonetworks pan-os A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administra | 0.3% | — |
| CVE-2024-9469 | MED 5.5 | paloaltonetworks cortex_xdr_agent A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then t | 0.2% | — |
| CVE-2024-9468 | HIGH 7.5 | paloaltonetworks pan-os A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condi | 0.4% | — |
| CVE-2024-9467 | MED 6.1 | paloaltonetworks expedition A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Expediti | 0.6% | — |
| CVE-2024-9466 | MED 6.5 | paloaltonetworks expedition A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials. | 13.5% | — |
| CVE-2024-9464 | MED 6.5 | paloaltonetworks expedition An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of | 82.6% | — |
| CVE-2024-9194 | CRIT 9.8 | octopus octopus_server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2 | 0.4% | — |
| CVE-2024-9120 | HIGH 8.8 | google chrome Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2024-8996 | HIGH 7.3 | grafana agent Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2 | 0.3% | — |
| CVE-2024-8975 | HIGH 7.3 | grafana alloy Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1. | 0.3% | — |
| CVE-2024-8752 | HIGH 7.5 | smart-hmi webiq The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system. | 11.8% | — |
| CVE-2024-8691 | HIGH 7.1 | paloaltonetworks pan-os A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vuln | 0.3% | — |
| CVE-2024-8690 | MED 4.4 | paloaltonetworks cortex_xdr_agent A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to per | 0.2% | — |
| CVE-2024-8688 | MED 4.4 | paloaltonetworks pan-os An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators (including read-only administrators) with access to the CLI to to read arbitrary files on the firewa | 0.2% | — |
| CVE-2024-8687 | HIGH 7.1 | paloaltonetworks globalprotect An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or pass | 0.4% | — |
| CVE-2024-8686 | HIGH 7.2 | paloaltonetworks pan-os A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall. | 1.4% | — |
| CVE-2024-8600 | HIGH 7.8 | autodesk autocad A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the con | 0.2% | — |
| CVE-2024-8599 | HIGH 7.8 | autodesk autocad A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the con | 0.2% | — |