58.070 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.070 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2013-6903 | MED 4.3 | cybozu garoon Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 1.2% | — |
| CVE-2013-5519 | MED 4.3 | cisco wireless_lan_controller Cross-site scripting (XSS) vulnerability in the management interface on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuf77810. | 1.2% | — |
| CVE-2013-3440 | MED 4.3 | cisco unified_operations_manager Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote attackers to inject arbitrary web script or HTML, and obtain improperly secured cookies, via unspecified vectors, aka Bug I | 1.2% | — |
| CVE-2013-1140 | MED 4.3 | cisco security_monitoring_analysis_and_response_system The XML parser in Cisco Security Monitoring, Analysis, and Response System (MARS) allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug | 1.2% | — |
| CVE-2013-1113 | MED 4.3 | cisco unified_communications_domain_manager Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via a crafted parameter value, aka Bug ID CSCue21042. | 1.2% | — |
| CVE-2012-4142 | MED 4.3 | opera opera_browser Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a c | 1.2% | — |
| CVE-2024-28899 | HIGH 8.8 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 1.2% | — |
| CVE-2023-31065 | CRIT 9.1 | apache inlong Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old session can be used by an attacker even after the user has been deleted or the password has been cha | 1.2% | — |
| CVE-2023-28158 | MED 6.5 | apache archiva Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user. | 1.2% | — |
| CVE-2022-46907 | MED 6.1 | apache jspwiki A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users | 1.2% | — |
| CVE-2021-26642 | HIGH 8.8 | xpressengine xpressengine When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the | 1.2% | — |
| CVE-2021-1465 | MED 4.3 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory traversal attack and obtain read access to sensitive files on an affected system. The vulnerability is | 1.2% | — |
| CVE-2017-6766 | HIGH 7.5 | cisco firesight_system_software A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting a | 1.2% | — |
| CVE-2017-5986 | MED 5.5 | linux linux_kernel Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain | 1.2% | — |
| CVE-2015-0631 | HIGH 7.1 | cisco ips_sensor_software Race condition in the SSL implementation on Cisco Intrusion Prevention System (IPS) devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an upgrade, aka Bug ID C | 1.2% | — |
| CVE-2001-0753 | HIGH 7.5 | cisco cbos Cisco CBOS 2.3.8 and earlier stores the passwords for (1) exec and (2) enable in cleartext in the NVRAM and a configuration file, which could allow unauthorized users to obtain the passwords and gain privileges. | 1.2% | — |
| CVE-2026-41602 | HIGH 7.5 | apache thrift Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. | 1.2% | — |
| CVE-2023-21539 | HIGH 7.5 | microsoft windows_10_20h2 Windows Authentication Remote Code Execution Vulnerability | 1.2% | — |
| CVE-2018-0138 | MED 5.3 | cisco secure_firewall_threat_defense A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies that are configured to block files transmitted to an affected device via the BitTorrent protocol. The vulnerabili | 1.2% | — |
| CVE-2017-2325 | MED 6.5 | juniper northstar_controller A buffer overflow vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to cause a buffer overflow leading to a denial of service. | 1.2% | — |
| CVE-2017-12299 | MED 5.3 | cisco firepower_extensible_operating_system A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall Services that could allow an unauthenticated, remote attacker to send traffic to the local IP address of the device, bypassi | 1.2% | — |
| CVE-2010-0925 | MED 5.0 | apple safari cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the SRC attribute of a (1) IMG or (2) IFRAME element. | 1.2% | — |
| CVE-2026-54118 | CRIT 9.8 | microsoft sql_server_2016 Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 1.2% | — |
| CVE-2026-54117 | CRIT 9.8 | microsoft sql_server_2016 Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 1.2% | — |
| CVE-2026-35435 | HIGH 8.6 | microsoft azure_ai_foundry Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. | 1.2% | — |