59.389 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.389 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-2947 | MED 5.5 | adobe acrobat Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have a security bypass vulnerability when manipulating Form Data Format (FDF). | 6.9% | — |
| CVE-2007-0451 | MED 4.3 | apache spamassassin Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage." | 6.9% | — |
| CVE-2022-21123 | MED 5.5 | debian debian_linux Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. | 6.9% | — |
| CVE-2018-0159 | HIGH 7.5 | cisco ios A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of servi | 6.9% | |
| CVE-2016-5397 | HIGH 8.8 | apache thrift The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0. | 6.9% | — |
| CVE-2015-6117 | MED 6.1 | microsoft sharepoint_foundation Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Secu | 6.9% | — |
| CVE-2006-3906 | MED 5.0 | cisco adaptive_security_appliance_software Internet Key Exchange (IKE) version 1 protocol, as implemented on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of IKE Phase-1 packets that exceed the session expira | 6.9% | — |
| CVE-2015-1636 | LOW 3.5 | microsoft sharepoint_foundation Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS | 6.9% | — |
| CVE-2016-0075 | MED 5.5 | microsoft windows_10 The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, ak | 6.9% | — |
| CVE-2020-1284 | MED 6.5 | microsoft windows_10 A denial of service vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Denial of Service Vulnerability'. | 6.9% | — |
| CVE-2021-21120 | HIGH 8.8 | google chrome Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 6.9% | — |
| CVE-2016-4978 | HIGH 7.2 | apache artemis The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Arte | 6.9% | — |
| CVE-2005-1792 | MED 5.0 | microsoft windows_xp Memory leak in Windows Management Instrumentation (WMI) service allows attackers to cause a denial of service (memory consumption and crash) by creating security contexts more quickly than they can be cleared from the RPC cache. | 6.9% | — |
| CVE-2024-30034 | MED 5.5 | microsoft windows_10_1809 Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability | 6.9% | — |
| CVE-2019-1064 | HIGH 7.8 | ransomware microsoft windows_10_1607 An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install pr | 6.9% | |
| CVE-2025-12428 | HIGH 8.8 | google chrome Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) | 6.9% | — |
| CVE-2021-30639 | HIGH 7.5 | apache tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset be | 6.9% | — |
| CVE-2011-0606 | HIGH 9.3 | adobe acrobat Stack-based buffer overflow in rt3d.dll in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspeci | 6.9% | — |
| CVE-2014-0653 | MED 4.3 | cisco adaptive_security_appliance The Identity Firewall (IDFW) functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to trigger authentication-state modifications via a crafted NetBIOS logout probe response, aka Bug ID CSCuj45340. | 6.9% | — |
| CVE-2018-8005 | MED 5.3 | apache traffic_server When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this iss | 6.9% | — |
| CVE-2008-6280 | MED 4.3 | cisco wrt160n Cross-site scripting (XSS) vulnerability in apply.cgi on the Linksys WRT160N allows remote attackers to inject arbitrary web script or HTML via the action parameter in a DHCP_Static operation. | 6.9% | — |
| CVE-2021-20322 | HIGH 7.4 | debian debian_linux A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source | 6.9% | — |
| CVE-1999-0967 | HIGH 10.0 | microsoft internet_explorer Buffer overflow in the HTML library used by Internet Explorer, Outlook Express, and Windows Explorer via the res: local resource protocol. | 6.9% | — |
| CVE-2019-1361 | MED 5.5 | microsoft windows_7 An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'. | 6.9% | — |
| CVE-2014-0096 | MED 4.3 | apache tomcat java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restricti | 6.9% | — |