59.264 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.264 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-38182 | HIGH 8.0 | microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 5.9% | — |
| CVE-2019-8980 | HIGH 7.5 | canonical ubuntu_linux A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures. | 5.9% | — |
| CVE-2021-21137 | MED 6.5 | google chrome Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page. | 5.9% | — |
| CVE-2012-3412 | HIGH 7.8 | canonical ubuntu_linux The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value. | 5.9% | — |
| CVE-2020-16927 | HIGH 7.5 | microsoft windows_10 <p>A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on | 5.9% | — |
| CVE-2010-3854 | MED 4.3 | apache couchdb Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 5.9% | — |
| CVE-2007-6704 | LOW 2.6 | f5 firepass_4100 Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activa | 5.9% | — |
| CVE-2011-2445 | HIGH 10.0 | adobe adobe_air Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corru | 5.9% | — |
| CVE-2020-11995 | CRIT 9.8 | apache dubbo A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, | 5.9% | — |
| CVE-2020-1045 | HIGH 7.5 | fedoraproject fedora <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name bei | 5.9% | — |
| CVE-2014-4667 | MED 5.0 | canonical ubuntu_linux The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. | 5.9% | — |
| CVE-1999-0560 | HIGH 10.0 | microsoft windows_nt A system-critical Windows NT file or directory has inappropriate permissions. | 5.9% | — |
| CVE-1999-0226 | HIGH 10.0 | microsoft windows_nt Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service. | 5.9% | — |
| CVE-2024-30279 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a | 5.9% | — |
| CVE-2020-0607 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'. | 5.9% | — |
| CVE-2009-5005 | MED 5.0 | apache qpid The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data. | 5.9% | — |
| CVE-2001-0346 | MED 5.0 | microsoft windows_2000 Handle leak in Microsoft Windows 2000 telnet service allows attackers to cause a denial of service by starting a large number of sessions and terminating them. | 5.9% | — |
| CVE-2020-1239 | HIGH 8.8 | microsoft windows_10 A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1238. | 5.9% | — |
| CVE-2016-0983 | HIGH 8.8 | adobe air_desktop_runtime Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20. | 5.9% | — |
| CVE-2016-0982 | HIGH 8.8 | adobe air_desktop_runtime Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20. | 5.9% | — |
| CVE-2014-0648 | HIGH 10.0 | cisco secure_access_control_system The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCu | 5.9% | — |
| CVE-2003-0647 | HIGH 7.5 | cisco ios Buffer overflow in the HTTP server for Cisco IOS 12.2 and earlier allows remote attackers to execute arbitrary code via an extremely long (2GB) HTTP GET request. | 5.9% | — |
| CVE-2019-0623 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. | 5.9% | — |
| CVE-2018-0855 | MED 4.3 | microsoft windows_7 The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vu | 5.9% | — |
| CVE-2018-0847 | MED 4.3 | microsoft internet_explorer Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how Internet Explore | 5.9% | — |