59.398 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.398 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2001-0904 | MED 5.0 | microsoft internet_explorer Internet Explorer 5.5 and 6 with the Q312461 (MS01-055) patch modifies the HTTP_USER_AGENT (UserAgent) information that indicates that the patch has been installed, which could allow remote malicious web sites to more easily identify and exploit vulnerable cli | 7.0% | — |
| CVE-1999-1055 | HIGH 7.5 | microsoft excel Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, aka the Excel "CALL Vulnerability." | 7.0% | — |
| CVE-2021-38665 | HIGH 7.4 | microsoft remote_desktop_client Remote Desktop Protocol Client Information Disclosure Vulnerability | 7.0% | — |
| CVE-2021-26893 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 7.0% | — |
| CVE-2017-0110 | MED 6.1 | microsoft exchange_server Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." | 7.0% | — |
| CVE-2021-30468 | HIGH 7.5 | apache cxf A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior | 7.0% | — |
| CVE-2007-1257 | HIGH 10.0 | cisco catalyst_6000_ws-svc-nam-1 The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address. | 7.0% | — |
| CVE-2015-7614 | MED 6.8 | adobe acrobat Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass JavaScript API e | 7.0% | — |
| CVE-2022-30157 | HIGH 8.8 | microsoft sharepoint_server Microsoft SharePoint Server Remote Code Execution Vulnerability | 7.0% | — |
| CVE-2006-6578 | HIGH 7.5 | microsoft internet_information_services Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated u | 7.0% | — |
| CVE-2020-3383 | HIGH 8.8 | cisco data_center_network_manager A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to a lack of proper input validation of path | 7.0% | — |
| CVE-2016-4448 | CRIT 9.8 | apple icloud Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors. | 7.0% | — |
| CVE-2017-0274 | MED 5.9 | microsoft windows_10 Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, an | 7.0% | — |
| CVE-2016-7864 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution. | 7.0% | — |
| CVE-2016-7859 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution. | 7.0% | — |
| CVE-2016-7858 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution. | 7.0% | — |
| CVE-2016-7857 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution. | 7.0% | — |
| CVE-2002-1593 | MED 5.0 | apache http_server mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module. | 7.0% | — |
| CVE-2017-11848 | MED 4.3 | microsoft internet_explorer Internet Explorer in Microsoft Microsoft Windows 7 SP1, Windows Server 2008 SP2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to det | 7.0% | — |
| CVE-2016-4102 | CRIT 9.8 | adobe acrobat Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code | 7.0% | — |
| CVE-2005-0904 | LOW 2.1 | microsoft windows_xp Remote Desktop in Windows XP SP1 does not verify the "Force shutdown from a remote system" setting, which allows remote attackers to shut down the system by executing TSShutdn.exe. | 7.0% | — |
| CVE-2004-2643 | LOW 3.7 | microsoft cabarc Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB archive. | 7.0% | — |
| CVE-2017-0175 | MED 4.7 | microsoft windows_7 The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information via a specially crafted document, aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability th | 7.0% | — |
| CVE-2020-11985 | MED 5.3 | apache http_server IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HT | 7.0% | — |
| CVE-2020-1930 | HIGH 8.1 | apache spamassassin A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a num | 7.1% | — |