57.954 CVE tracked
784 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.954 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-36280 | MED 6.3 | debian debian_linux An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the | 0.8% | — |
| CVE-2022-22998 | HIGH 8.0 | westerndigital my_cloud_home_duo_firmware Implemented protections on AWS credentials that were not properly protected. | 0.8% | — |
| CVE-2022-22152 | HIGH 7.7 | juniper contrail_service_orchestration A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tena | 0.8% | — |
| CVE-2020-2035 | LOW 3.0 | paloaltonetworks pan-os When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Se | 0.8% | — |
| CVE-2017-5035 | HIGH 8.1 | debian debian_linux Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site. | 0.8% | — |
| CVE-2016-8395 | MED 4.7 | linux linux_kernel A denial of service vulnerability in the NVIDIA camera driver could enable an attacker to cause a local permanent denial of service, which may require reflashing the operating system to repair the device. This issue is rated as High due to the possibility of l | 0.8% | — |
| CVE-2014-3820 | MED 4.3 | juniper junos_pulse_access_control_service Cross-site scripting (XSS) vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service d | 0.8% | — |
| CVE-2011-3355 | HIGH 7.3 | gnome evolution-data-server3 evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials | 0.8% | — |
| CVE-2009-0058 | MED 6.1 | cisco 4400_wireless_lan_controller The Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.x before 5.2 allow remote attackers to cause a denial of service ( | 0.8% | — |
| CVE-2026-23658 | HIGH 8.6 | microsoft azure_devops Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2025-49740 | HIGH 8.8 | microsoft windows_10_1507 Protection mechanism failure in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. | 0.8% | — |
| CVE-2023-22415 | HIGH 7.5 | juniper junos An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On all MX Series and SRX Series platform, when H.323 ALG is enabled and specific H.323 packet | 0.8% | — |
| CVE-2023-22410 | HIGH 7.5 | juniper junos A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Networks Junos OS on MX Series platforms with MPC10/MPC11 line cards, allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). Devices are only vulnerable | 0.8% | — |
| CVE-2021-36174 | MED 4.3 | fortinet fortiportal A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a denial of service attack via specially crafted license blobs. | 0.8% | — |
| CVE-2021-34782 | MED 4.3 | cisco catalyst_center A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be restricted. The attacker must have valid device credentials. This vulnerability is due to improper ac | 0.8% | — |
| CVE-2019-12694 | MED 6.7 | cisco secure_firewall_threat_defense A vulnerability in the command line interface (CLI) of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker with administrative privileges to execute commands on the underlying operating system with root privileges. The vu | 0.8% | — |
| CVE-2019-12674 | HIGH 8.2 | cisco firepower_4110_firmware Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. | 0.8% | — |
| CVE-2019-1037 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. | 0.8% | — |
| CVE-2017-12262 | HIGH 8.8 | cisco application_policy_infrastructure_controller_enterprise_module A vulnerability within the firewall configuration of the Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) could allow an unauthenticated, adjacent attacker to gain privileged access to services only available on the internal netwo | 0.8% | — |
| CVE-2009-0876 | MED 6.9 | sun xvm_virtualbox Sun xVM VirtualBox 2.0.0, 2.0.2, 2.0.4, 2.0.6r39760, 2.1.0, 2.1.2, and 2.1.4r42893 on Linux allows local users to gain privileges via a hardlink attack, which preserves setuid/setgid bits on Linux, related to DT_RPATH:$ORIGIN. | 0.8% | — |
| CVE-2008-7211 | MED 6.9 | soundblaster ensoniq_pci_es1371_wdm_driver CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as used in Ensoniq PCI 1371 sound cards and when running on Windows Vista, does not create a Functional Device Object (FDO) to prevent user-moade access to the Physical Device Object (PDO), which allows lo | 0.8% | — |
| CVE-2026-34350 | MED 6.5 | microsoft windows_server_2025 Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network. | 0.8% | — |
| CVE-2025-53799 | MED 5.5 | microsoft 365_copilot Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. | 0.8% | — |
| CVE-2025-21397 | HIGH 7.8 | microsoft 365_apps Microsoft Office Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2023-40374 | MED 5.3 | ibm db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Force ID: 263575. | 0.8% | — |