57.961 CVE tracked
784 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.961 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-26010 | HIGH 7.5 | fortinet fortios A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through 7.0.3, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7. | 0.8% | — |
| CVE-2023-0925 | CRIT 9.8 | softwareag webmethods Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default) and two RMI interfaces (listening on a single, dynamically assigned TCP high port). Port 2099 ser | 0.8% | — |
| CVE-2021-1570 | MED 6.5 | cisco jabber Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive information or cause a denial of service (DoS) condition. For more information about these vulnerabili | 0.8% | — |
| CVE-2020-0772 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when Windows Error Reporting improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Error Reporting Elevation of Privilege Vulner | 0.8% | — |
| CVE-2016-1434 | MED 6.5 | cisco ip_phone_8800_series_firmware The license-certificate upload functionality on Cisco 8800 phones with software 11.0(1) allows remote authenticated users to delete arbitrary files via an invalid file, aka Bug ID CSCuz03010. | 0.8% | — |
| CVE-2015-1043 | LOW 3.3 | vmware fusion The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors. | 0.8% | — |
| CVE-2026-71330 | HIGH 7.5 | microsoft windows_10_1607 Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network. | 0.8% | — |
| CVE-2026-70587 | HIGH 7.5 | microsoft windows_10_1607 Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. | 0.8% | — |
| CVE-2026-58617 | HIGH 8.1 | microsoft 365_copilot Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2026-47287 | MED 6.5 | microsoft visual_studio_code Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | 0.8% | — |
| CVE-2025-53792 | CRIT 9.1 | microsoft azure_portal Azure Portal Elevation of Privilege Vulnerability | 0.8% | — |
| CVE-2025-30398 | HIGH 8.1 | microsoft nuance_powerscribe_360 Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. | 0.8% | — |
| CVE-2025-23334 | MED 5.9 | nvidia triton_inference_server NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by sending a request. A successful exploit of this vulnerability might lead to information disclosure. | 0.8% | — |
| CVE-2024-53948 | MED 5.3 | apache superset Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. | 0.8% | — |
| CVE-2024-44998 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb" after calling vcc->push() because the skb is released. | 0.8% | — |
| CVE-2024-38175 | CRIT 9.6 | microsoft azure_managed_instance_for_apache_cassandra An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a network. | 0.8% | — |
| CVE-2023-36042 | MED 6.2 | microsoft visual_studio_2019 Visual Studio Denial of Service Vulnerability | 0.8% | — |
| CVE-2022-41105 | MED 5.5 | microsoft 365_apps Microsoft Excel Information Disclosure Vulnerability | 0.8% | — |
| CVE-2022-41104 | MED 5.5 | microsoft 365_apps Microsoft Excel Security Feature Bypass Vulnerability | 0.8% | — |
| CVE-2022-41060 | MED 5.5 | microsoft 365_apps Microsoft Word Information Disclosure Vulnerability | 0.8% | — |
| CVE-2021-33744 | MED 5.3 | microsoft windows_10 Windows Secure Kernel Mode Security Feature Bypass Vulnerability | 0.8% | — |
| CVE-2021-29964 | HIGH 7.1 | mozilla firefox A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thun | 0.8% | — |
| CVE-2021-29686 | HIGH 8.8 | ibm security_identity_manager IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to. IBM X-Force ID: 200015 | 0.8% | — |
| CVE-2021-1271 | MED 4.8 | cisco web_security_virtual_appliance A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected dev | 0.8% | — |
| CVE-2020-24559 | HIGH 7.8 | trendmicro apex_one A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipulate a certain binary to load and run a script from a user-writable folder, which then would allow | 0.8% | — |