58.617 CVE tracked
797 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.617 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-4240 | MED 5.0 | cisco ip_communicator Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656. | 2.4% | — |
| CVE-2002-1230 | MED 4.6 | microsoft windows_2000 NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code as LocalSystem via "shatter" style attack by sending a WM_COPYDATA message followed by a WM_TIMER message, as demonstrated by | 2.4% | — |
| CVE-2022-22973 | HIGH 7.8 | vmware cloud_foundation VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'. | 2.4% | — |
| CVE-2019-19378 | HIGH 7.8 | linux linux_kernel In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/btrfs/raid56.c. | 2.4% | — |
| CVE-2019-1002 | MED 4.2 | microsoft edge A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context | 2.4% | — |
| CVE-2019-0755 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0767, CVE-2019-0775, CVE-2019-0782. | 2.4% | — |
| CVE-2019-0608 | MED 4.3 | microsoft edge A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1357. | 2.4% | — |
| CVE-2013-5016 | HIGH 7.6 | broadcom symantec_critical_system_protection Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to bypass policy settings via unspecified vectors. | 2.4% | — |
| CVE-2008-4544 | MED 5.0 | cisco unity Unspecified vulnerability in an unspecified Microsoft API, as used by Cisco Unity and possibly other products, allows remote attackers to cause a denial of service by sending crafted packets to dynamic UDP ports, related to a "processing error." | 2.4% | — |
| CVE-2007-3615 | HIGH 7.8 | sap internet_communication_manager Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key para | 2.4% | — |
| CVE-2007-1833 | MED 5.0 | cisco unified_callmanager The Skinny Call Control Protocol (SCCP) implementation in Cisco Unified CallManager (CUCM) 3.3 before 3.3(5)SR2a, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3)SR1, and 5.0 before 5.0(4a)SU1 allows remote attackers to cause a denial of service (loss of voice services | 2.4% | — |
| CVE-2024-49121 | HIGH 7.5 | microsoft windows_10_1507 Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | 2.4% | — |
| CVE-2020-1552 | HIGH 8.0 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnera | 2.4% | — |
| CVE-2017-16639 | MED 4.3 | torproject tor_browser Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a different vulnerability than CVE-2017-16541. User interaction is required to trigger this vulnerability. | 2.4% | — |
| CVE-2024-28935 | HIGH 8.8 | microsoft odbc_driver_for_sql_server Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | 2.4% | — |
| CVE-2024-28930 | HIGH 8.8 | microsoft odbc_driver_for_sql_server Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | 2.4% | — |
| CVE-2024-28908 | HIGH 8.8 | microsoft ole_db_driver_for_sql_server Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability | 2.4% | — |
| CVE-2022-38023 | HIGH 8.1 | fedoraproject fedora Netlogon RPC Elevation of Privilege Vulnerability | 2.4% | — |
| CVE-2010-2026 | MED 6.4 | cisco scientific_atlanta_webstar_dpc2100r2 The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows remote attackers to bypass authentication, and reset the modem or replace the firmware, via a direct request to an unspecified page. | 2.4% | — |
| CVE-2009-0321 | MED 4.3 | apple safari Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) s | 2.4% | — |
| CVE-2006-3290 | MED 5.0 | cisco wireless_control_system HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL req | 2.4% | — |
| CVE-2009-0080 | MED 6.9 | microsoft windows_server_2008 The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local use | 2.4% | — |
| CVE-2017-6662 | HIGH 8.0 | cisco evolved_programmable_network_manager A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perfo | 2.4% | — |
| CVE-2016-3302 | MED 6.3 | microsoft windows_10 Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607, when the lock screen is enabled, do not properly restrict the loading of web content, which allows physically proximate attackers to execute arbitrary code via | 2.4% | — |
| CVE-2016-1455 | HIGH 7.5 | cisco nx-os Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration, which allows remote attackers to obtain sensitive information via TCP or UDP traffic, aka Bug ID CSCuz05365. | 2.4% | — |