59.646 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.646 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-0281 | HIGH 7.8 | microsoft office Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoin | 15.8% | — |
| CVE-2002-0862 | MED 6.8 | microsoft internet_explorer The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do | 15.8% | — |
| CVE-2004-0173 | MED 5.0 | apache http_server Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences. | 15.8% | — |
| CVE-2016-0166 | HIGH 7.5 | microsoft internet_explorer Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | 15.8% | — |
| CVE-2016-0159 | HIGH 7.5 | microsoft internet_explorer Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | 15.8% | — |
| CVE-2016-0157 | HIGH 7.5 | microsoft edge Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0155 and CVE-2016-0156. | 15.8% | — |
| CVE-2006-6310 | MED 5.0 | microsoft internet_explorer Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (crash) via an invalid src attribute value ("?") in an HTML frame tag that is in a frameset tag with a large rows attribute. NOTE: The provenance of this info | 15.8% | — |
| CVE-2003-1559 | MED 5.0 | microsoft ie Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data. | 15.8% | — |
| CVE-2009-3955 | HIGH 10.0 | adobe acrobat Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extensi | 15.8% | — |
| CVE-2023-20048 | CRIT 9.9 | cisco secure_firewall_management_center A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by | 15.8% | — |
| CVE-2025-20265 | CRIT 10.0 | cisco secure_firewall_management_center A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This vulnerability is | 15.8% | — |
| CVE-2002-0861 | HIGH 7.5 | microsoft office_web_components Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy method of the Cell object or (2) the Paste method of the Range object. | 15.8% | — |
| CVE-2008-3009 | HIGH 10.0 | microsoft windows_media_format_runtime Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote | 15.8% | — |
| CVE-2018-11412 | MED 5.9 | canonical ubuntu_linux In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated i | 15.8% | — |
| CVE-2019-0571 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, | 15.8% | — |
| CVE-2016-3326 | MED 5.3 | microsoft edge Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3327. | 15.8% | — |
| CVE-2023-36019 | CRIT 9.6 | microsoft azure_logic_apps Microsoft Power Platform Connector Spoofing Vulnerability | 15.8% | — |
| CVE-2007-3481 | MED 5.0 | microsoft internet_explorer Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the documen | 15.8% | — |
| CVE-2026-21513 | HIGH 8.8 | microsoft windows_10_1607 Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. | 15.9% | |
| CVE-2019-1333 | HIGH 8.8 | microsoft windows_10 A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. | 15.9% | — |
| CVE-2013-0015 | MED 4.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 9 does not properly perform auto-selection of the Shift JIS encoding, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site that triggers cross-domain scrolling events | 15.9% | — |
| CVE-2008-4299 | MED 5.0 | microsoft internet_authentication_service_helper_com_component A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers to cause a denial of service (browser crash) via a large integer value in the first argument to the PutProperty method. | 15.9% | — |
| CVE-2010-3904 | HIGH 7.8 | canonical ubuntu_linux The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via cr | 15.9% | |
| CVE-2018-8475 | HIGH 8.8 | microsoft windows_10 A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Se | 15.9% | — |
| CVE-2002-2077 | MED 5.0 | microsoft windows_2000 The DCOM client in Windows 2000 before SP3 does not properly clear memory before sending an "alter context" request, which may allow remote attackers to obtain sensitive information by sniffing the session. | 15.9% | — |