57.961 CVE tracked
784 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.961 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2006-5757 | LOW 1.2 | linux linux_kernel Race condition in the __find_get_block_slow function in the ISO9660 filesystem in Linux 2.6.18 and possibly other versions allows local users to cause a denial of service (infinite loop) by mounting a crafted ISO9660 filesystem containing malformed data struct | 0.8% | — |
| CVE-2025-53783 | HIGH 7.5 | microsoft dynamics_365_guides Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2023-41682 | HIGH 8.1 | fortinet fortisandbox A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, For | 0.8% | — |
| CVE-2023-38154 | HIGH 7.8 | microsoft windows_10_1809 Windows Kernel Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2022-44692 | HIGH 7.8 | microsoft 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability | 0.8% | — |
| CVE-2021-21055 | MED 6.2 | adobe dreamweaver Adobe Dreamweaver versions 21.0 (and earlier) and 20.2 (and earlier) is affected by an untrusted search path vulnerability that could result in information disclosure. An attacker with physical access to the system could replace certain configuration files and | 0.8% | — |
| CVE-2020-4598 | MED 6.1 | ibm security_guardium_insights IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL dis | 0.8% | — |
| CVE-2018-19666 | HIGH 7.8 | ossec ossec The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server. | 0.8% | — |
| CVE-2012-1666 | MED 6.9 | vmware esx Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View before 5.1, and VMware ESX 4.1 before U3 and 5.0 before P03 allows local users to gain privileges via a | 0.8% | — |
| CVE-2026-49432 | HIGH 7.5 | apache activemq Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For th | 0.8% | — |
| CVE-2025-47295 | LOW 3.7 | fortinet fortios A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the FGFM daemon via a specially crafted request, under rare conditions tha | 0.8% | — |
| CVE-2025-21274 | MED 5.5 | microsoft windows_10_1507 Windows Event Tracing Denial of Service Vulnerability | 0.8% | — |
| CVE-2025-20234 | MED 5.3 | cisco secure_endpoint A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. | 0.8% | — |
| CVE-2024-50033 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of | 0.8% | — |
| CVE-2024-29007 | HIGH 7.3 | apache cloudstack The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended t | 0.8% | — |
| CVE-2024-23331 | HIGH 7.5 | vitejs vite Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar | 0.8% | — |
| CVE-2022-26786 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2022-23825 | MED 6.5 | amd a10-9600p_firmware Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. | 0.8% | — |
| CVE-2021-1234 | MED 5.3 | cisco catalyst_sd-wan_manager A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the vManage software must be in | 0.8% | — |
| CVE-2020-17012 | HIGH 7.8 | microsoft windows_10 Windows Bind Filter Driver Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2020-1347 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations, aka 'Windows Storage Services Elevation of Privilege Vulnerability'. | 0.8% | — |
| CVE-2017-12213 | MED 4.3 | cisco ios_xe A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This c | 0.8% | — |
| CVE-2016-9257 | MED 6.1 | f5 big-ip_access_policy_manager In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, al | 0.8% | — |
| CVE-2002-0051 | HIGH 7.8 | microsoft windows_2000 Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access. | 0.8% | — |
| CVE-2026-32191 | CRIT 9.8 | microsoft bing_images Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network. | 0.8% | — |