58.849 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.849 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-47942 | HIGH 8.8 | linux linux_kernel An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command. | 3.7% | — |
| CVE-2013-0267 | HIGH 8.8 | apache vcl The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nodeAdmin, manageGroup, resourceGrant, or userGrant permissions to gain privileges, cause a denial of se | 3.7% | — |
| CVE-2016-1457 | HIGH 8.8 | cisco secure_firewall_management_center The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 allows | 3.7% | — |
| CVE-2016-1430 | HIGH 8.8 | cisco rv180_vpn_router_firmware Cisco RV180 and RV180W devices allow remote authenticated users to execute arbitrary commands as root via a crafted HTTP request, aka Bug ID CSCuz48592. | 3.7% | — |
| CVE-2008-4576 | HIGH 7.8 | linux linux_kernel sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and triggers the OOPS when t | 3.7% | — |
| CVE-2020-17081 | MED 5.5 | microsoft raw_image_extension Microsoft Raw Image Extension Information Disclosure Vulnerability | 3.7% | — |
| CVE-2011-3247 | HIGH 9.3 | apple quicktime Integer overflow in Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT file. | 3.7% | — |
| CVE-1999-0289 | MED 5.0 | apache http_server The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL. | 3.7% | — |
| CVE-2020-17105 | HIGH 7.8 | microsoft av1_video_extension AV1 Video Extension Remote Code Execution Vulnerability | 3.7% | — |
| CVE-2018-3155 | HIGH 7.7 | canonical ubuntu_linux Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via | 3.7% | — |
| CVE-2005-0195 | MED 5.0 | cisco ios Cisco IOS 12.0S through 12.3YH allows remote attackers to cause a denial of service (device restart) via a crafted IPv6 packet. | 3.7% | — |
| CVE-2025-48989 | HIGH 7.5 | apache tomcat Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, | 3.7% | — |
| CVE-2018-0818 | HIGH 7.5 | microsoft chakracore Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Featu | 3.7% | — |
| CVE-1999-0366 | HIGH 7.5 | microsoft windows_nt In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value. | 3.7% | — |
| CVE-2023-38143 | HIGH 7.8 | microsoft windows_10_1507 Windows Common Log File System Driver Elevation of Privilege Vulnerability | 3.7% | — |
| CVE-2019-1457 | HIGH 7.8 | microsoft office A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel Security Feature Bypass'. | 3.7% | — |
| CVE-2018-0786 | HIGH 7.5 | microsoft .net_core Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature By | 3.7% | — |
| CVE-2016-6374 | CRIT 9.8 | cisco cloud_services_platform_2100 Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote attackers to execute arbitrary code via a crafted dnslookup command in an HTTP request, aka Bug ID CSCuz89093. | 3.7% | — |
| CVE-2013-3658 | HIGH 9.4 | vmware esx Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors. | 3.7% | — |
| CVE-2021-1297 | HIGH 7.5 | cisco rv160_vpn_router_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to conduct directory traversal attacks and overwrite certain files that | 3.7% | — |
| CVE-2021-1296 | HIGH 7.5 | cisco rv160_vpn_router_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to conduct directory traversal attacks and overwrite certain files that | 3.7% | — |
| CVE-2022-34700 | HIGH 8.8 | microsoft dynamics_365 Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability | 3.7% | — |
| CVE-2022-24103 | HIGH 7.8 | adobe acrobat Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th | 3.7% | — |
| CVE-2015-8215 | MED 5.0 | linux linux_kernel net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum comp | 3.7% | — |
| CVE-2021-27737 | HIGH 7.5 | apache traffic_server Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. | 3.7% | — |