56.807 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.807 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-7251 | MED 6.1 | microsoft sql_server Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability." | 8.2% | — |
| CVE-2018-1320 | HIGH 7.5 | apache thrift Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be dis | 8.2% | — |
| CVE-2026-59309 | CRIT 9.8 | vmware vcenter_server VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. | 8.2% | — |
| CVE-2023-38148 | HIGH 8.8 | microsoft windows_10_21h2 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability | 8.2% | — |
| CVE-2001-0917 | MED 5.0 | apache tomcat Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension. | 8.2% | — |
| CVE-2020-0640 | HIGH 7.5 | microsoft internet_explorer A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'. | 8.2% | — |
| CVE-2007-0714 | HIGH 9.3 | apple quicktime Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie with a User Data Atom (UDTA) with an Atom size field with a large valu | 8.2% | — |
| CVE-2006-4183 | MED 6.8 | microsoft directx_sdk Heap-based buffer overflow in Microsoft DirectX SDK (February 2006) and probably earlier, including 9.0c End User Runtimes, allows context-dependent attackers to execute arbitrary code via a crafted Targa file with a run-length-encoding (RLE) compression that | 8.2% | — |
| CVE-2003-0904 | MED 6.0 | microsoft exchange_server Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method f | 8.2% | — |
| CVE-2001-0766 | CRIT 9.8 | apache http_server Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters. | 8.2% | — |
| CVE-2020-8879 | MED 4.3 | foxitsoftware foxit_studio_photo This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a maliciou | 8.2% | — |
| CVE-2020-8877 | MED 4.3 | foxitsoftware foxit_studio_photo This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a maliciou | 8.2% | — |
| CVE-2015-8407 | HIGH 10.0 | adobe air Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0 | 8.2% | — |
| CVE-2015-3135 | HIGH 10.0 | adobe air Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 1 | 8.2% | — |
| CVE-2013-0630 | HIGH 10.0 | adobe adobe_air Buffer overflow in Adobe Flash Player before 10.3.183.50 and 11.x before 11.5.502.146 on Windows and Mac OS X, before 10.3.183.50 and 11.x before 11.2.202.261 on Linux, before 11.1.111.31 on Android 2.x and 3.x, and before 11.1.115.36 on Android 4.x; Adobe AIR | 8.2% | — |
| CVE-2024-38227 | HIGH 7.2 | microsoft sharepoint_server Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.2% | — |
| CVE-2012-5633 | MED 5.8 | apache cxf The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request. | 8.2% | — |
| CVE-2009-2846 | HIGH 7.8 | linux linux_kernel The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is | 8.2% | — |
| CVE-1999-1237 | HIGH 10.0 | apache http_server Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified meth | 8.2% | — |
| CVE-2023-36713 | MED 5.5 | microsoft windows_10_1507 Windows Common Log File System Driver Information Disclosure Vulnerability | 8.2% | — |
| CVE-2018-1327 | HIGH 7.5 | apache struts The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handl | 8.2% | — |
| CVE-2015-0349 | HIGH 10.0 | adobe flash_player Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than | 8.2% | — |
| CVE-2009-2901 | MED 4.3 | apache tomcat The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements v | 8.2% | — |
| CVE-2006-5395 | HIGH 7.5 | microsoft class_package_export_tool Buffer overflow in Microsoft Class Package Export Tool (aka clspack.exe) allows context-dependent attackers to execute arbitrary code via a long string. NOTE: the provenance of this information is unknown; the details are obtained from third party information | 8.2% | — |
| CVE-2018-15979 | HIGH 7.5 | adobe acrobat_dc Adobe Acrobat and Reader versions 2019.008.20080 and earlier, 2017.011.30105 and earlier, and 2015.006.30456 and earlier have a ntlm sso hash theft vulnerability. Successful exploitation could lead to information disclosure. | 8.2% | — |