56.625 CVE tracked
776 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.625 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-1999-0045 | HIGH 7.5 | apache http_server List of arbitrary files on Web host via nph-test-cgi script. | 26.2% | — |
| CVE-2018-4937 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. | 26.2% | — |
| CVE-2018-4935 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. | 26.2% | — |
| CVE-2017-8589 | CRIT 9.8 | microsoft windows_10 Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way that Windows Search | 26.2% | — |
| CVE-2014-2314 | MED 4.3 | atlassian jira Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors. | 26.2% | — |
| CVE-2004-2137 | MED 5.0 | microsoft outlook_express Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive info | 26.1% | — |
| CVE-2003-0910 | HIGH 7.2 | microsoft windows_2000 The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descr | 26.1% | — |
| CVE-2020-8191 | MED 6.1 | citrix application_delivery_controller_firmware Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS). | 26.1% | — |
| CVE-2004-0199 | MED 5.1 | microsoft windows_2003_server Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd | 26.1% | — |
| CVE-2015-8644 | HIGH 8.8 | adobe air Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execu | 26.1% | — |
| CVE-2012-0175 | HIGH 8.8 | microsoft windows_2003_server The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory, | 26.1% | — |
| CVE-2023-36802 | HIGH 7.8 | microsoft windows_10_1809 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | 26.1% | |
| CVE-1999-0682 | MED 5.0 | microsoft exchange_server Microsoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled. | 26.1% | — |
| CVE-2007-1946 | HIGH 10.0 | microsoft windows_xp Integer overflow in Windows Explorer in Microsoft Windows XP SP1 might allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large width dimension in a crafted BMP image, as demonstrated by w4intof. | 26.1% | — |
| CVE-2017-11263 | HIGH 8.8 | adobe acrobat Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the internal data structure manipulation related to document encoding. Succes | 26.1% | — |
| CVE-2020-0668 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0669, CVE-2020-0670, CVE-2020-0671, CVE-2020-0672. | 26.1% | — |
| CVE-2004-0900 | HIGH 10.0 | microsoft windows_nt The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulne | 26.0% | — |
| CVE-2016-1011 | HIGH 8.8 | adobe air_desktop_runtime Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than | 26.0% | — |
| CVE-2003-0823 | HIGH 7.5 | microsoft ie Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027. | 26.0% | — |
| CVE-2014-0098 | MED 5.0 | apache http_server The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during | 26.0% | — |
| CVE-2015-6108 | HIGH 9.3 | microsoft .net_framework The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT Gold and 8.1; Office 2007 SP3; Office 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, | 26.0% | — |
| CVE-2017-0133 | HIGH 7.5 | microsoft edge A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in | 26.0% | — |
| CVE-2017-0030 | HIGH 7.8 | microsoft office Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (m | 26.0% | — |
| CVE-2024-37085 | MED 6.8 | ransomware vmware cloud_foundation VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere | 26.0% | |
| CVE-2019-1913 | CRIT 9.8 | cisco sf-220-24_firmware Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the under | 25.9% | — |