57.971 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.971 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-20343 | HIGH 8.6 | cisco identity_services_engine A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to | 0.7% | — |
| CVE-2024-43612 | MED 6.9 | microsoft power_bi_report_server Power BI Report Server Spoofing Vulnerability | 0.7% | — |
| CVE-2024-35884 | CRIT 9.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel When rx-udp-gro-forwarding is enabled UDP packets might be GROed when being forwarded. If such packets might land in a tunnel this | 0.7% | — |
| CVE-2024-35880 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: hold io_buffer_list reference over mmap If we look up the kbuf, ensure that it doesn't get unregistered until after we're done with it. Since we're inside mmap, we cannot safe | 0.7% | — |
| CVE-2023-36046 | HIGH 7.1 | microsoft windows_11_21h2 Windows Authentication Denial of Service Vulnerability | 0.7% | — |
| CVE-2023-28352 | HIGH 7.4 | faronics insight An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been e | 0.7% | — |
| CVE-2021-1475 | MED 6.5 | cisco umbrella Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these v | 0.7% | — |
| CVE-2019-6658 | MED 4.3 | f5 big-ip_advanced_firewall_manager On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BIG-IP user to run an SQL injection attack. | 0.7% | — |
| CVE-2018-8356 | MED 5.5 | microsoft .net_core A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microso | 0.7% | — |
| CVE-2014-7997 | MED 6.1 | cisco ios The DHCP implementation in Cisco IOS on Aironet access points does not properly handle error conditions with short leases and unsuccessful lease-renewal attempts, which allows remote attackers to cause a denial of service (device restart) by triggering a trans | 0.7% | — |
| CVE-2012-3051 | MED 6.1 | cisco nexus_7000 Cisco NX-OS 5.2 and 6.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (process crash or packet loss) via a large number of ARP packets, aka Bug ID CSCtr44822. | 0.7% | — |
| CVE-2026-34538 | MED 6.5 | apache airflow Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected | 0.7% | — |
| CVE-2025-66169 | MED 5.3 | apache camel Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14. | 0.7% | — |
| CVE-2025-59250 | HIGH 8.1 | microsoft jdbc_driver_for_sql_server Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network. | 0.7% | — |
| CVE-2025-24083 | HIGH 7.8 | microsoft 365_apps Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2025-24081 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2025-24080 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2025-24079 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 0.7% | — |
| CVE-2024-47695 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the | 0.7% | — |
| CVE-2023-28313 | MED 6.1 | microsoft send_customer_voice_survey_from_dynamics_365 Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability | 0.7% | — |
| CVE-2022-33947 | MED 5.4 | f5 big-ip_domain_name_system In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker with | 0.7% | — |
| CVE-2022-22181 | HIGH 8.0 | juniper junos A reflected Cross-site Scripting (XSS) vulnerability in J-Web of Juniper Networks Junos OS allows a network-based authenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web. This may | 0.7% | — |
| CVE-2022-22175 | HIGH 7.5 | juniper junos An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated networked attacker to cause a flowprocessing daemon (flowd) crash and thereby a Denial of Service (DoS). Continued receipt of th | 0.7% | — |
| CVE-2020-4340 | MED 4.3 | ibm security_secret_server IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180. | 0.7% | — |
| CVE-2019-1722 | MED 6.5 | cisco expressway_series A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an a | 0.7% | — |