57.551 CVE tracked
782 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.551 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-34327 | HIGH 8.2 | microsoft partner_center Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2025-59328 | MED 6.5 | apache fory A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an ex | 0.6% | — |
| CVE-2024-47502 | HIGH 7.5 | juniper junos_os_evolved An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In specific cases the state of TCP sessions that are | 0.6% | — |
| CVE-2024-26175 | HIGH 7.8 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2023-46717 | HIGH 7.5 | fortinet fortios An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with FortiAuthenticator in HA may allow a readonly user to gain read-write access via successive log | 0.6% | — |
| CVE-2023-0977 | MED 6.7 | trellix agent A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsvc process memory block resulting in the service becoming unavailable. | 0.6% | — |
| CVE-2022-21834 | HIGH 7.0 | microsoft windows_10 Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2022-21833 | HIGH 7.8 | microsoft windows_10 Virtual Machine IDE Drive Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-47368 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: enetc: Fix illegal access when reading affinity_hint irq_set_affinity_hit() stores a reference to the cpumask_t parameter in the irq descriptor, and that reference can be accessed later from | 0.6% | — |
| CVE-2021-38963 | HIGH 8.0 | ibm aspera_console IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerability. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnera | 0.6% | — |
| CVE-2021-34536 | HIGH 7.8 | microsoft windows_10 Windows Storage Spaces Controller Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-34445 | HIGH 7.8 | microsoft windows_10 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-33773 | HIGH 7.8 | microsoft windows_10 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2021-1374 | MED 4.8 | cisco ios_xe A vulnerability in the web-based management interface of Cisco IOS XE Wireless Controller software for the Catalyst 9000 Family of switches could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the | 0.6% | — |
| CVE-2020-24439 | LOW 2.8 | adobe acrobat Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemen | 0.6% | — |
| CVE-2014-8884 | MED 6.1 | linux linux_kernel Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a la | 0.6% | — |
| CVE-2026-52946 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a s | 0.6% | — |
| CVE-2025-47168 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.6% | — |
| CVE-2025-29837 | MED 5.5 | microsoft windows_10_1507 Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to disclose information locally. | 0.6% | — |
| CVE-2024-53167 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nfs/blocklayout: Don't attempt unregister for invalid block device Since commit d869da91cccb ("nfs/blocklayout: Fix premature PR key unregistration") an unmount of a pNFS SCSI layout-enabled | 0.6% | — |
| CVE-2024-27018 | HIGH 8.2 | fedoraproject fedora In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: skip conntrack input hook for promisc packets For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge inpu | 0.6% | — |
| CVE-2024-26626 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipmr: fix kernel panic when forwarding mcast packets The stacktrace was: [ 86.305548] BUG: kernel NULL pointer dereference, address: 0000000000000092 [ 86.306815] #PF: supervisor read ac | 0.6% | — |
| CVE-2024-21315 | HIGH 7.8 | microsoft defender_for_endpoint Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2023-52610 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prep | 0.6% | — |
| CVE-2023-52290 | HIGH 8.1 | apache streampark In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is | 0.6% | — |