58.518 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.518 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2018-13376 | HIGH 7.5 | fortinet fortios An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimer response web pages, potentially causing sensitive data to be displayed in the HTTP response. | 2.1% | — |
| CVE-2013-5567 | MED 5.4 | cisco adaptive_security_appliance_software Cisco Adaptive Security Appliance (ASA) Software 8.4(.6) and earlier, when using an unsupported configuration with overlapping criteria for filtering and inspection, allows remote attackers to cause a denial of service (traffic loop and device crash) via a pac | 2.1% | — |
| CVE-2013-2601 | HIGH 7.5 | citrix xenclient_xt The NDVM in Citrix XenClient XT before 2.1.3 and 3.x before 3.1.4 allows remote attackers to execute arbitrary commands by using the UIVM to create a network connection. | 2.1% | — |
| CVE-2023-29216 | CRIT 9.8 | apache linkis In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code executi | 2.1% | — |
| CVE-2023-29215 | CRIT 9.8 | apache linkis In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Theref | 2.1% | — |
| CVE-2021-28455 | HIGH 8.8 | microsoft 365_apps Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2014-3095 | LOW 3.5 | ibm db2 The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted UNION clause in a subqu | 2.1% | — |
| CVE-2023-33308 | CRIT 9.8 | fortinet fortios A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or com | 2.1% | — |
| CVE-2021-31963 | HIGH 7.1 | microsoft sharepoint_foundation Microsoft SharePoint Server Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2018-0278 | MED 6.5 | cisco secure_firewall_management_center A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensitive data about the system. The vulnerability is due to improper cross-origin domain protections for the WebSocket proto | 2.1% | — |
| CVE-2022-20723 | MED 5.5 | cisco ios_xe Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system | 2.1% | — |
| CVE-2021-40111 | MED 6.5 | apache james In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial | 2.1% | — |
| CVE-2018-9185 | HIGH 8.1 | fortinet fortios An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature. | 2.1% | — |
| CVE-2015-0649 | HIGH 7.8 | cisco ios Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun63514. | 2.1% | — |
| CVE-2022-28249 | MED 5.5 | adobe acrobat Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory st | 2.1% | — |
| CVE-2021-21976 | HIGH 7.2 | vmware vsphere_replication vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command injection vulnerability which may allow an authenticated admin user to perform a remote code execution. | 2.1% | — |
| CVE-2018-0034 | MED 5.3 | juniper junos A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted IPv6 packet to the system. This issue is limited to systems which receives IPv6 DHCP packets on a sy | 2.1% | — |
| CVE-2009-0627 | HIGH 7.8 | cisco nexus_5000 Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1), when running on Nexus 5000 platforms, allows remote attackers to cause a denial of service (crash) via an unspecified "sequence of TCP packets" related to "TCP State manipulation," possibly related | 2.1% | — |
| CVE-2023-36763 | HIGH 7.5 | microsoft 365_apps Microsoft Outlook Information Disclosure Vulnerability | 2.1% | — |
| CVE-2015-4199 | HIGH 7.1 | cisco ios Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity | 2.1% | — |
| CVE-2002-0848 | MED 5.0 | cisco vpn_5000_concentrator_series_software Cisco VPN 5000 series concentrator hardware 6.0.21.0002 and earlier, and 5.2.23.0003 and earlier, when using RADIUS with a challenge type of Password Authentication Protocol (PAP) or Challenge, sends the user password in cleartext in a validation retry request | 2.1% | — |
| CVE-2024-38044 | HIGH 7.2 | microsoft windows_server_2012 DHCP Server Service Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2022-24473 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2021-1579 | HIGH 8.1 | cisco application_policy_infrastructure_controller A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to | 2.1% | — |
| CVE-2019-1814 | HIGH 8.6 | cisco sf300-08_firmware A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthenticated, remote attacker to cause the device to become low on system memory, which in turn could lead to | 2.1% | — |