58.151 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.151 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-14685 | HIGH 7.8 | trendmicro antivirus_\+_security_2019 A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service. | 0.6% | — |
| CVE-2009-2407 | MED 6.9 | linux linux_kernel Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involvi | 0.6% | — |
| CVE-2026-23651 | MED 6.7 | microsoft aci_confidential_containers Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2025-33075 | HIGH 7.8 | microsoft windows_10_1507 Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally. | 0.6% | — |
| CVE-2025-24997 | MED 4.4 | microsoft windows_10_21h2 Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally. | 0.6% | — |
| CVE-2025-21235 | HIGH 7.8 | microsoft windows_10_21h2 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2025-21234 | HIGH 7.8 | microsoft windows_10_21h2 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-49979 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: gso: fix tcp fraglist segmentation after pull from frag_list Detect tcp gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, | 0.6% | — |
| CVE-2024-48988 | HIGH 7.6 | apache streampark SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This vulnerability is present only in the distribution package (Sprin | 0.6% | — |
| CVE-2024-46667 | HIGH 7.5 | fortinet fortisiem A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0 through 7.1.5 may allow an attacker to deny valid TLS traffic via consuming all allotted connections. | 0.6% | — |
| CVE-2024-39552 | HIGH 7.5 | juniper junos An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause the RPD process to crash leading to a Denial of Servic | 0.6% | — |
| CVE-2024-33608 | HIGH 7.5 | f5 big-ip_access_policy_manager When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.6% | — |
| CVE-2022-43951 | MED 5.3 | fortinet fortinac An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below may allow an unauthenticated attacker to access sensitive information via cra | 0.6% | — |
| CVE-2022-30994 | HIGH 7.5 | acronis cyber_protect Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240 | 0.6% | — |
| CVE-2022-30993 | HIGH 7.5 | acronis cyber_protect Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 | 0.6% | — |
| CVE-2020-5922 | HIGH 8.8 | f5 big-ip_access_policy_manager In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser. | 0.6% | — |
| CVE-2020-3535 | HIGH 7.8 | cisco webex_teams A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker needs valid credentials on the Windows s | 0.6% | — |
| CVE-2019-1758 | MED 4.7 | cisco ios A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attacker to access the network prior to authentication. The vulnerability is due to how the 802.1x packets are handled in the | 0.6% | — |
| CVE-2015-8944 | MED 5.5 | google android The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices, uses weak permissions for /proc/iomem, which allows local users to obtain sensitive information by reading | 0.6% | — |
| CVE-2013-7144 | MED 4.3 | linecorp line LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | 0.6% | — |
| CVE-2013-2141 | LOW 2.1 | linux linux_kernel The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill s | 0.6% | — |
| CVE-2026-48448 | HIGH 8.6 | adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file syst | 0.6% | — |
| CVE-2026-33858 | HIGH 8.8 | apache airflow Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended | 0.6% | — |
| CVE-2026-21222 | MED 5.5 | microsoft windows_10_1607 Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. | 0.6% | — |
| CVE-2025-59240 | MED 5.5 | microsoft 365_apps Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 0.6% | — |