58.650 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.650 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-21197 | MED 6.5 | microsoft windows_10_1507 Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content. | 3.2% | — |
| CVE-2024-29053 | HIGH 8.8 | microsoft defender_for_iot Microsoft Defender for IoT Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2024-21323 | HIGH 8.8 | microsoft defender_for_iot Microsoft Defender for IoT Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2022-36364 | HIGH 8.8 | apache apache_calcite_avatica Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead | 3.2% | — |
| CVE-2020-17016 | HIGH 8.0 | microsoft sharepoint_enterprise_server Microsoft SharePoint Server Spoofing Vulnerability | 3.2% | — |
| CVE-2014-1730 | HIGH 7.8 | google chrome Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type conf | 3.2% | — |
| CVE-2016-7891 | MED 6.1 | adobe robohelp Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks. | 3.2% | — |
| CVE-2021-24099 | MED 6.5 | microsoft lync_server Skype for Business and Lync Denial of Service Vulnerability | 3.2% | — |
| CVE-2016-3655 | CRIT 9.8 | paloaltonetworks pan-os The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call. | 3.2% | — |
| CVE-2001-0711 | MED 5.0 | cisco ios Cisco IOS 11.x and 12.0 with ATM support allows attackers to cause a denial of service via the undocumented Interim Local Management Interface (ILMI) SNMP community string. | 3.2% | — |
| CVE-2003-0512 | MED 5.0 | cisco ios Cisco IOS 12.2 and earlier generates a "% Login invalid" message instead of prompting for a password when an invalid username is provided, which allows remote attackers to identify valid usernames on the system and conduct brute force password guessing, as rep | 3.2% | — |
| CVE-2016-0712 | MED 6.1 | apache jetspeed Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal. | 3.2% | — |
| CVE-2012-3949 | HIGH 7.8 | cisco ios The SIP implementation in Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su5, 8.x before 8.5(1)su4, and 8.6 before 8.6(2a)su1; Cisco IOS 12.2 through 12.4 and 15.0 through 15.2; and Cisco IOS XE 3.3.xSG before 3.3.1SG, 3.4.xS, and 3.5.xS | 3.2% | — |
| CVE-2007-5085 | MED 5.0 | apache geronimo Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors. | 3.2% | — |
| CVE-2022-20825 | CRIT 9.8 | cisco rv110w_firmware A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in | 3.2% | — |
| CVE-2021-1674 | HIGH 8.8 | microsoft windows_10 Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability | 3.2% | — |
| CVE-2021-1673 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2021-1671 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2021-1669 | HIGH 8.8 | microsoft remote_desktop Windows Remote Desktop Security Feature Bypass Vulnerability | 3.2% | — |
| CVE-2021-1666 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2021-1664 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2021-1660 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2021-1658 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2016-1442 | HIGH 8.8 | cisco prime_infrastructure The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280. | 3.2% | — |
| CVE-2009-0137 | HIGH 10.0 | apple safari Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues." | 3.2% | — |