59.289 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.289 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-2156 | HIGH 7.5 | debian debian_linux A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remot | 6.2% | — |
| CVE-2019-7096 | CRIT 9.8 | adobe flash_player Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 6.2% | — |
| CVE-2012-4363 | HIGH 9.3 | adobe acrobat_reader Multiple unspecified vulnerabilities in Adobe Reader through 10.1.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, related to "sixteen more crashes affecting Windows, OS X, | 6.2% | — |
| CVE-2010-0378 | HIGH 8.8 | adobe flash_player Use-after-free vulnerability in Adobe Flash Player 6.0.79, as distributed in Microsoft Windows XP SP2 and SP3, allows remote attackers to execute arbitrary code by unloading a Flash object that is currently being accessed by a script, leading to memory corrupt | 6.2% | — |
| CVE-2020-1036 | CRIT 9.0 | microsoft windows_server_2008 A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is un | 6.2% | — |
| CVE-2012-0767 | MED 6.1 | adobe flash_player Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to in | 6.2% | |
| CVE-2021-21121 | CRIT 9.6 | google chrome Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | 6.2% | — |
| CVE-2018-1025 | MED 4.3 | microsoft edge An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory, aka "Microsoft Browser Information Disclosure Vulnerability." This affects Internet Explorer 11, Microsoft Edge. | 6.2% | — |
| CVE-2003-1469 | MED 5.0 | macromedia coldfusion The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to obtain the full path of the web server via a direct request to CFIDE/probe.cfm, which leaks the path in an error message. | 6.2% | — |
| CVE-2014-0564 | HIGH 10.0 | adobe air_desktop_runtime Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execu | 6.2% | — |
| CVE-2004-1575 | MED 5.0 | apache xerces-c\+\+ The XML parser in Xerces-C++ 2.5.0 allows remote attackers to cause a denial of service (CPU consumption) via XML attributes in a crafted XML document. | 6.2% | — |
| CVE-2024-38244 | HIGH 7.8 | microsoft windows_10_1507 Kernel Streaming Service Driver Elevation of Privilege Vulnerability | 6.2% | — |
| CVE-2006-5805 | MED 5.0 | microsoft ie Microsoft Internet Explorer 7 allows remote attackers to cause a security certificate from a secure web site to appear invalid via a link to res://ieframe.dll/invalidcert.htm with the target site as an argument, which displays the site's URL in the address bar | 6.2% | — |
| CVE-1999-0917 | MED 5.1 | microsoft internet_explorer The Preloader ActiveX control used by Internet Explorer allows remote attackers to read arbitrary files. | 6.2% | — |
| CVE-2025-5349 | HIGH 8.8 | citrix netscaler_application_delivery_controller Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway | 6.2% | — |
| CVE-2011-0586 | HIGH 9.3 | adobe acrobat Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X do not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors. | 6.2% | — |
| CVE-2018-12856 | MED 6.5 | adobe acrobat_dc Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 6.2% | — |
| CVE-2021-38153 | MED 5.9 | apache kafka Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or highe | 6.2% | — |
| CVE-2019-7832 | CRIT 9.8 | adobe acrobat_dc Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vuln | 6.2% | — |
| CVE-2019-1209 | MED 6.5 | microsoft lync An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'. | 6.2% | — |
| CVE-2008-4391 | HIGH 9.3 | cisco wvc54gc Stack-based buffer overflow in the SetSource method in the NetCamPlayerWeb11gv2 ActiveX control in NetCamPlayerWeb11gv2.ocx on the Cisco Linksys WVC54GC wireless video camera before firmware 1.25 allows remote attackers to execute arbitrary code via long inval | 6.2% | — |
| CVE-2000-1218 | CRIT 9.8 | microsoft windows_2000 The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts that it did not query, which allows remote attackers to poison | 6.2% | — |
| CVE-2017-11307 | CRIT 9.8 | adobe acrobat Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in th | 6.2% | — |
| CVE-2017-11306 | CRIT 9.8 | adobe acrobat Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in th | 6.2% | — |
| CVE-2017-11253 | CRIT 9.8 | adobe acrobat Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in th | 6.2% | — |