58.560 CVE tracked
797 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.560 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-42889 | CRIT 9.8 | apache commons_text Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringL | 99.9% | — |
| CVE-2021-1497 | CRIT 9.8 | cisco hyperflex_hx_data_platform Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Deta | 99.9% | |
| CVE-2025-24813 | CRIT 9.8 | apache tomcat Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t | 99.9% | |
| CVE-2019-0232 | HIGH 8.1 | apache tomcat When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Window | 99.9% | — |
| CVE-2024-32113 | CRIT 9.8 | apache ofbiz Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue. | 99.9% | |
| CVE-2019-0604 | CRIT 9.8 | ransomware microsoft sharepoint_enterprise_server A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594. | 99.9% | |
| CVE-2018-0296 | HIGH 7.5 | cisco adaptive_security_appliance_software A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on cer | 99.9% | |
| CVE-2021-22986 | CRIT 9.8 | ransomware f5 big-ip_access_policy_manager On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote | 99.9% | |
| CVE-2023-46604 | CRIT 10.0 | ransomware apache activemq The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized clas | 99.9% | |
| CVE-2014-0497 | CRIT 9.8 | adobe flash_player Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors. | 99.9% | |
| CVE-2021-27065 | HIGH 7.8 | ransomware microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 99.9% | |
| CVE-2019-1653 | HIGH 7.5 | cisco rv320_firmware A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls f | 99.9% | |
| CVE-2021-31166 | CRIT 9.8 | microsoft windows_10_2004 HTTP Protocol Stack Remote Code Execution Vulnerability | 99.9% | |
| CVE-2021-21972 | CRIT 9.8 | ransomware vmware cloud_foundation The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system t | 99.9% | |
| CVE-2015-4000 | LOW 3.7 | apple iphone_os The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello wi | 99.9% | — |
| CVE-2024-0012 | CRIT 9.8 | ransomware paloaltonetworks pan-os An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or | 99.8% | |
| CVE-2017-12635 | CRIT 9.8 | apache couchdb Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, incl | 99.8% | — |
| CVE-2017-7269 | CRIT 9.8 | microsoft internet_information_services Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PRO | 99.8% | |
| CVE-2012-1459 | MED 4.3 | ahnlab v3_internet_security The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, | 99.8% | — |
| CVE-2020-0796 | CRIT 10.0 | ransomware microsoft windows_10_1903 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. | 99.8% | |
| CVE-2025-53771 | MED 6.5 | microsoft sharepoint_server Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 99.8% | — |
| CVE-2022-39952 | CRIT 9.8 | fortinet fortinac A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute u | 99.8% | — |
| CVE-2021-34527 | HIGH 8.8 | ransomware microsoft windows_10_1507 A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could the | 99.8% | |
| CVE-2021-31207 | MED 6.6 | ransomware microsoft exchange_server Microsoft Exchange Server Security Feature Bypass Vulnerability | 99.8% | |
| CVE-2020-13927 | CRIT 9.8 | apache airflow The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and i | 99.8% |