58.254 CVE tracked
789 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.254 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-42985 | HIGH 8.8 | microsoft remote_desktop_client Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 1.3% | — |
| CVE-2024-43474 | HIGH 7.6 | microsoft sql_server_2017 Microsoft SQL Server Information Disclosure Vulnerability | 1.3% | — |
| CVE-2024-30098 | HIGH 7.5 | microsoft windows_10_1507 Windows Cryptographic Services Security Feature Bypass Vulnerability | 1.3% | — |
| CVE-2023-41774 | HIGH 8.1 | microsoft windows_10_1507 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2023-41773 | HIGH 8.1 | microsoft windows_10_1507 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2020-17020 | LOW 3.3 | microsoft 365_apps Microsoft Word Security Feature Bypass Vulnerability | 1.3% | — |
| CVE-2021-0207 | HIGH 7.5 | juniper junos An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain traffic to pass through the device upon receipt from an ingress interface filtering certain specific typ | 1.3% | — |
| CVE-2020-5880 | HIGH 7.1 | f5 big-ip_access_policy_manager Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server. | 1.3% | — |
| CVE-2020-1361 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker would first need code execution on a victim system, aka 'Windows WalletService Information Disclosure Vulnerability'. | 1.3% | — |
| CVE-2020-1296 | MED 5.5 | microsoft windows_10 A vulnerability exists in the way the Windows Diagnostics & feedback settings app handles objects in memory, aka 'Windows Diagnostics & feedback Information Disclosure Vulnerability'. | 1.3% | — |
| CVE-2019-15707 | MED 4.9 | fortinet fortimail An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for. | 1.3% | — |
| CVE-2019-13404 | HIGH 7.8 | python python The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user | 1.3% | — |
| CVE-2017-9150 | MED 5.5 | linux linux_kernel The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive address information via c | 1.3% | — |
| CVE-2017-5100 | HIGH 8.8 | debian debian_linux A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | 1.3% | — |
| CVE-2012-1324 | HIGH 7.1 | cisco ios Race condition in the Zone-Based Firewall in Cisco IOS 15.1 and 15.2, when IPS policies are configured, allows remote attackers to cause a denial of service (device crash) by sending IPv6 packets, aka Bug ID CSCtk53534. | 1.3% | — |
| CVE-2023-28326 | CRIT 9.8 | apache openmeetings Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room | 1.3% | — |
| CVE-2022-2162 | HIGH 8.8 | fedoraproject fedora Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page. | 1.3% | — |
| CVE-2018-13378 | HIGH 7.2 | fortinet fortisiem An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code. | 1.3% | — |
| CVE-2017-8468 | HIGH 7.8 | microsoft windows_10 Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run processes in an elevated context when the Windows kernel improperly handles objects in memory, aka "Win32k | 1.3% | — |
| CVE-2016-6398 | MED 5.3 | cisco ios The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data, aka Bug ID CSCvb16274. | 1.3% | — |
| CVE-2009-2508 | MED 6.9 | microsoft windows_server_2003 The single sign-on implementation in Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers | 1.3% | — |
| CVE-2024-38011 | HIGH 8.0 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 1.3% | — |
| CVE-2024-37987 | HIGH 8.0 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 1.3% | — |
| CVE-2024-37975 | HIGH 8.0 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 1.3% | — |
| CVE-2023-52832 | CRIT 9.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211_get_tx_power() We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset powe | 1.3% | — |