58.535 CVE tracked
797 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.535 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-26422 | HIGH 7.2 | microsoft lync_server Skype for Business and Lync Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2021-1719 | HIGH 8.0 | microsoft sharepoint_enterprise_server Microsoft SharePoint Elevation of Privilege Vulnerability | 2.2% | — |
| CVE-2007-5460 | MED 4.6 | microsoft windows_mobile Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user's PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to decode a PIN/ | 2.2% | — |
| CVE-2023-33141 | HIGH 7.5 | microsoft yet_another_reverse_proxy Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability | 2.2% | — |
| CVE-2023-32030 | HIGH 7.5 | microsoft .net_framework .NET and Visual Studio Denial of Service Vulnerability | 2.2% | — |
| CVE-2010-0686 | HIGH 7.5 | vmware esx_server WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability. | 2.2% | — |
| CVE-2022-20753 | MED 4.7 | cisco rv340_firmware A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-suppli | 2.2% | — |
| CVE-2021-44791 | MED 6.1 | apache druid In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. | 2.2% | — |
| CVE-2021-24117 | MED 4.9 | apache teaclave_sgx_sdk In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in is | 2.2% | — |
| CVE-2009-4420 | HIGH 7.8 | f5 big-ip_application_security_manager Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager (ASM) 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and Protocol Security Manager (PSM) 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1, allows remote attackers to cause a denia | 2.2% | — |
| CVE-2008-0751 | MED 4.3 | s9y serendipity_event_freetag Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to plugin/tag/. | 2.2% | — |
| CVE-2021-39829 | HIGH 7.8 | adobe framemaker Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requ | 2.2% | — |
| CVE-2020-3411 | HIGH 7.5 | cisco catalyst_center A vulnerability in Cisco DNA Center software could allow an unauthenticated remote attacker access to sensitive information on an affected system. The vulnerability is due to improper handling of authentication tokens by the affected software. An attacker coul | 2.2% | — |
| CVE-2018-15448 | HIGH 7.5 | cisco registered_envelope_service A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to discover sensitive user information. The attacker could use this information to conduct additional reconnaissance attacks. | 2.2% | — |
| CVE-2020-24490 | MED 6.5 | bluez bluez Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ. | 2.2% | — |
| CVE-2019-1742 | MED 5.3 | cisco ios_xe A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this | 2.2% | — |
| CVE-2018-10877 | HIGH 7.3 | canonical ubuntu_linux Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. | 2.2% | — |
| CVE-2015-2472 | MED 4.3 | microsoft windows_10 Remote Desktop Session Host (RDSH) in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not pro | 2.2% | — |
| CVE-2023-30846 | CRIT 9.1 | microsoft typed-rest-client typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as fol | 2.2% | — |
| CVE-2021-34534 | MED 6.8 | microsoft windows_10 Windows MSHTML Platform Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2020-17153 | MED 4.3 | microsoft edge Microsoft Edge for Android Spoofing Vulnerability | 2.2% | — |
| CVE-2020-10892 | HIGH 8.8 | foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 2.2% | — |
| CVE-2020-10890 | HIGH 8.8 | foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 2.2% | — |
| CVE-2018-12542 | CRIT 9.8 | eclipse vert.x In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location tha | 2.2% | — |
| CVE-2017-3165 | MED 5.4 | apache brooklyn In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of se | 2.2% | — |