57.971 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.971 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-49407 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plock_op" and a followed send_op() will append it to a global send_list data st | 0.9% | — |
| CVE-2022-35735 | HIGH 7.2 | f5 big-ip_access_policy_manager In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource Administrator or Manager privileges can create or modify existing monitor objects in the Configuratio | 0.9% | — |
| CVE-2020-7831 | HIGH 8.8 | inogard ebiz4u A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able to use startup menu directory via directory traversal for automatic execution. The victim user need t | 0.9% | — |
| CVE-2025-20354 | CRIT 9.8 | cisco unified_contact_center_express A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system. This vulnerability | 0.9% | — |
| CVE-2025-20186 | HIGH 8.8 | cisco ios_xe A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected d | 0.9% | — |
| CVE-2023-20051 | MED 5.8 | cisco packet_data_network_gateway A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP traffic from being processed over an IPsec connection. This vulnerability is due to the VPP improperly | 0.9% | — |
| CVE-2020-20950 | MED 5.9 | ietf public_key_cryptography_standards_\#1 Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queri | 0.9% | — |
| CVE-2017-6134 | MED 6.5 | f5 big-ip_access_policy_manager In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash. | 0.9% | — |
| CVE-2017-0534 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produc | 0.9% | — |
| CVE-2017-0533 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produc | 0.9% | — |
| CVE-2017-0461 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produc | 0.9% | — |
| CVE-2017-0459 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produc | 0.9% | — |
| CVE-2016-8477 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produ | 0.9% | — |
| CVE-2016-8413 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produ | 0.9% | — |
| CVE-2015-0596 | MED 6.8 | cisco webex_meetings_server Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163. | 0.9% | — |
| CVE-2004-0554 | LOW 2.1 | avaya converged_communications_server Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "cras | 0.9% | — |
| CVE-2025-29812 | HIGH 7.8 | microsoft windows_11_22h2 Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate privileges locally. | 0.9% | — |
| CVE-2024-30314 | HIGH 7.8 | adobe dreamweaver Dreamweaver Desktop versions 21.3 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue doe | 0.9% | — |
| CVE-2023-51650 | HIGH 7.5 | apache hertzbeat Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Versi | 0.9% | — |
| CVE-2023-50380 | MED 6.5 | apache ambari XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege esc | 0.9% | — |
| CVE-2022-25108 | MED 5.5 | foxit pdf_editor Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the pointer is used without proper validation. | 0.9% | — |
| CVE-2021-42299 | MED 5.6 | microsoft surface_pro_3_firmware Microsoft Surface Pro 3 Security Feature Bypass Vulnerability | 0.9% | — |
| CVE-2018-17039 | MED 6.1 | 1234n minicms MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled. | 0.9% | — |
| CVE-2018-0363 | HIGH 8.8 | cisco unified_communications_manager_im_and_presence_service A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary acti | 0.9% | — |
| CVE-2017-5074 | HIGH 8.0 | google chrome A use after free in Chrome Apps in Google Chrome prior to 59.0.3071.86 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, related to Bluetooth. | 0.9% | — |