57.971 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.971 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-18660 | MED 4.7 | canonical ubuntu_linux The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. | 0.7% | — |
| CVE-2026-62835 | CRIT 9.3 | microsoft azure_portal Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. | 0.7% | — |
| CVE-2025-37871 | HIGH 7.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation: T1 | 0.7% | — |
| CVE-2024-26851 | HIGH 7.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. v | 0.7% | — |
| CVE-2024-26845 | HIGH 7.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list tak | 0.7% | — |
| CVE-2023-6546 | HIGH 7.0 | fedoraproject fedora A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem o | 0.7% | — |
| CVE-2022-39950 | HIGH 8.0 | fortinet fortianalyzer An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege leve | 0.7% | — |
| CVE-2020-15940 | MED 4.1 | fortinet forticlient_enterprise_management_server An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server. | 0.7% | — |
| CVE-2019-7588 | MED 6.7 | exacq enterprise_system_manager A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows | 0.7% | — |
| CVE-2018-17891 | LOW 3.7 | carestream carestream_vue_ris Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical informatio | 0.7% | — |
| CVE-2016-0947 | HIGH 7.8 | adobe acrobat Untrusted search path vulnerability in Adobe Download Manager, as used in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X, | 0.7% | — |
| CVE-1999-0460 | LOW 2.1 | linux linux_kernel Buffer overflow in Linux autofs module through long directory names allows local users to perform a denial of service. | 0.7% | — |
| CVE-1999-0451 | LOW 2.1 | linux linux_kernel Denial of service in Linux 2.0.36 allows local users to prevent any server from listening on any non-privileged port. | 0.7% | — |
| CVE-2024-28921 | MED 6.7 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.7% | — |
| CVE-2022-22182 | HIGH 8.8 | juniper junos A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos OS J-Web allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator. This issue | 0.7% | — |
| CVE-2022-20815 | MED 6.1 | cisco unified_communications_manager A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) c | 0.7% | — |
| CVE-2022-20800 | MED 6.1 | cisco unified_communications_manager A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unifie | 0.7% | — |
| CVE-2021-47354 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: drm/sched: Avoid data corruptions Wait for all dependencies of a job to complete before killing it to avoid data corruptions. | 0.7% | — |
| CVE-2021-3679 | MED 5.5 | debian debian_linux A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve | 0.7% | — |
| CVE-2021-32594 | MED 5.4 | fortinet fortiportal An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-privileged user to potentially tamper with the underlying system's files via the | 0.7% | — |
| CVE-2021-1143 | MED 4.3 | cisco connected_mobile_experiences A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on the system. The vulnerability is due to a lack of authorization checks for certain API GET requests. A | 0.7% | — |
| CVE-2019-14283 | MED 6.8 | linux linux_kernel In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been in | 0.7% | — |
| CVE-2019-12675 | HIGH 8.8 | cisco firepower_4110_firmware Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. | 0.7% | — |
| CVE-2018-15334 | MED 4.3 | f5 big-ip_access_policy_manager A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication. | 0.7% | — |
| CVE-2017-12612 | HIGH 7.8 | apache spark In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with | 0.7% | — |