58.444 CVE tracked
792 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.444 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-59292 | HIGH 8.2 | microsoft azure_compute_gallery External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-59291 | HIGH 8.2 | microsoft azure_compute_gallery External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-53868 | HIGH 8.7 | f5 big-ip_access_policy_manager When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. Note: Software versions which have reached End of Technical Support (EoTS) are | 0.4% | — |
| CVE-2025-48008 | HIGH 7.5 | f5 big-ip_access_policy_manager When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which hav | 0.4% | — |
| CVE-2025-38146 | CRIT 9.4 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A | 0.4% | — |
| CVE-2024-30302 | MED 5.5 | adobe acrobat Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of t | 0.4% | — |
| CVE-2024-26926 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in binder_get_object() Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In do | 0.4% | — |
| CVE-2023-49106 | MED 4.6 | hitachi device_manager Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects Hitachi Device Manager: before 8.8.5-04. | 0.4% | — |
| CVE-2023-26273 | MED 4.3 | ibm qradar_security_information_and_event_manager IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 248134. | 0.4% | — |
| CVE-2023-24946 | HIGH 7.8 | microsoft windows_10_1507 Windows Backup Service Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2022-22384 | MED 4.3 | ibm security_verify_privilege_on-premises IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Force ID: 221961. | 0.4% | — |
| CVE-2020-36694 | MED 6.7 | linux linux_kernel An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables rules replacement. This could be exploited with th | 0.4% | — |
| CVE-2019-5667 | HIGH 7.8 | nvidia gpu_driver NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSetRootPageTable in which the application dereferences a pointer that it expects to be valid, but is NULL, which may lead to code execution, d | 0.4% | — |
| CVE-2019-1839 | MED 6.7 | cisco cbr-8_firmware A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly san | 0.4% | — |
| CVE-2019-12381 | MED 5.5 | linux linux_kernel An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: this is | 0.4% | — |
| CVE-2015-4244 | HIGH 7.2 | cisco asr_5000_series_software The boot implementation on Cisco ASR 5000 and 5500 devices with software 14.0 allows local users to execute arbitrary Linux commands by leveraging administrative privileges for storage of these commands in a Compact Flash (CF) file, aka Bug ID CSCuu75278. | 0.4% | — |
| CVE-2011-4330 | HIGH 7.2 | linux linux_kernel Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field. | 0.4% | — |
| CVE-2009-3939 | HIGH 7.1 | avaya aura_application_enablement_services The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file. | 0.4% | — |
| CVE-2008-3389 | MED 4.6 | ingres ingres Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before ru | 0.4% | — |
| CVE-2007-6267 | LOW 2.1 | citrix edgesight_for_endpoints Citrix EdgeSight 4.2 and 4.5 for Presentation Server, EdgeSight 4.2 and 4.5 for Endpoints, and EdgeSight for NetScaler 1.0 and 1.1 do not properly store database credentials in configuration files, which allows local users to obtain sensitive information. | 0.4% | — |
| CVE-2004-0565 | LOW 2.1 | gentoo linux Floating point information leak in the context switch code for Linux 2.4.x only checks the MFH bit but does not verify the FPH owner, which allows local users to read register values of other processes by setting the MFH bit. | 0.4% | — |
| CVE-2004-0003 | MED 4.6 | linux linux_kernel Unknown vulnerability in Linux kernel before 2.4.22 allows local users to gain privileges, related to "R128 DRI limits checking." | 0.4% | — |
| CVE-2026-64380 | HIGH 8.2 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remainin | 0.4% | — |
| CVE-2026-62869 | HIGH 8.8 | microsoft entra_id Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-49177 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally. | 0.4% | — |