58.304 CVE tracked
789 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.304 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-20960 | HIGH 8.0 | microsoft power_apps Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network. | 0.5% | — |
| CVE-2025-60704 | HIGH 7.5 | microsoft windows_10_1607 Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2025-55699 | MED 5.5 | microsoft windows_10_1507 Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2025-38089 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If | 0.5% | — |
| CVE-2025-26678 | HIGH 8.4 | microsoft windows_10_1809 Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally. | 0.5% | — |
| CVE-2025-24986 | MED 6.5 | microsoft azure_promptflow_core Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network. | 0.5% | — |
| CVE-2024-53122 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the | 0.5% | — |
| CVE-2024-43535 | HIGH 7.0 | microsoft windows_10_1507 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2024-39468 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock. | 0.5% | — |
| CVE-2024-26692 | HIGH 8.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: smb: Fix regression in writes when non-standard maximum write size negotiated The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an | 0.5% | — |
| CVE-2023-38738 | MED 6.8 | ibm openpages_with_watson IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of s | 0.5% | — |
| CVE-2023-28656 | HIGH 8.1 | f5 nginx_api_connectivity_manager NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.5% | — |
| CVE-2023-21537 | HIGH 7.8 | microsoft windows_10_1607 Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2023-20060 | MED 6.1 | cisco prime_collaboration_deployment A vulnerability in the web-based management interface of Cisco Prime Collaboration Deployment could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web | 0.5% | — |
| CVE-2022-27230 | HIGH 7.5 | f5 big-ip_access_policy_manager On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of F5 BIG-IP Guided Co | 0.5% | — |
| CVE-2022-20927 | HIGH 7.7 | cisco adaptive_security_appliance_software A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Thi | 0.5% | — |
| CVE-2020-9291 | MED 6.3 | fortinet forticlient An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack. | 0.5% | — |
| CVE-2020-26541 | MED 6.5 | linux linux_kernel The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c. | 0.5% | — |
| CVE-2018-14656 | HIGH 7.0 | linux linux_kernel A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log. | 0.5% | — |
| CVE-2026-71558 | CRIT 9.8 | apache fory Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing | 0.5% | — |
| CVE-2026-69282 | HIGH 8.8 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.5% | — |
| CVE-2026-69273 | HIGH 8.8 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 0.5% | — |
| CVE-2026-64142 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against m_fp_list lookups ksmbd_durable_scavenger() has two related races against any walker that iterates f_ci->m_fp_list, including ksmbd_lookup_fd_ino | 0.5% | — |
| CVE-2026-63800 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_p | 0.5% | — |
| CVE-2026-57969 | HIGH 8.8 | microsoft azure_cyclecloud Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 0.5% | — |