59.329 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.329 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2009-4246 | HIGH 9.3 | realnetworks helix_player Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows user-assisted | 7.3% | — |
| CVE-2008-2307 | HIGH 9.3 | apple safari Unspecified vulnerability in WebKit in Apple Safari before 3.1.2, as distributed in Mac OS X before 10.5.4, and standalone for Windows and Mac OS X 10.4, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vec | 7.3% | — |
| CVE-2023-36713 | MED 5.5 | microsoft windows_10_1507 Windows Common Log File System Driver Information Disclosure Vulnerability | 7.3% | — |
| CVE-2022-38051 | HIGH 7.8 | microsoft windows_10 Windows Graphics Component Elevation of Privilege Vulnerability | 7.3% | — |
| CVE-2022-38050 | HIGH 7.8 | microsoft windows_10 Win32k Elevation of Privilege Vulnerability | 7.3% | — |
| CVE-2019-7968 | CRIT 9.8 | adobe photoshop_cc Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. | 7.3% | — |
| CVE-2016-8739 | HIGH 7.5 | apache cxf The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk. | 7.3% | — |
| CVE-2018-1040 | MED 5.3 | microsoft windows_10 A denial of service vulnerability exists in the way that the Windows Code Integrity Module performs hashing, aka "Windows Code Integrity Module Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 200 | 7.3% | — |
| CVE-2002-2009 | MED 5.0 | apache tomcat Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message. | 7.3% | — |
| CVE-2013-2850 | HIGH 7.9 | linux linux_kernel Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruptio | 7.3% | — |
| CVE-2018-8175 | MED 6.5 | microsoft windows_10 An denial of service vulnerability exists when Windows NT WEBDAV Minirdr attempts to query a WEBDAV directory, aka "WEBDAV Denial of Service Vulnerability." This affects Windows 10 Servers, Windows 10. | 7.3% | — |
| CVE-2025-52436 | HIGH 8.8 | fortinet fortisandbox An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all ver | 7.3% | — |
| CVE-2010-0130 | HIGH 8.8 | adobe shockwave_player Integer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via a crafted .dir (aka Director) file. | 7.3% | — |
| CVE-2023-20569 | MED 4.7 | amd epyc_72f3_firmware A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. | 7.3% | — |
| CVE-2016-7861 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution. | 7.3% | — |
| CVE-2016-7860 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution. | 7.3% | — |
| CVE-2023-41835 | HIGH 7.5 | apache struts When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 | 7.3% | — |
| CVE-2022-26151 | HIGH 7.2 | citrix xenmobile_server Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. | 7.3% | — |
| CVE-1999-0723 | HIGH 7.1 | microsoft windows_2000 The Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input. | 7.3% | — |
| CVE-2016-4248 | HIGH 8.8 | adobe flash_player Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than | 7.3% | — |
| CVE-2020-1493 | MED 5.5 | microsoft 365_apps An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users | 7.3% | — |
| CVE-2017-6744 | HIGH 8.8 | cisco ios The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. | 7.3% | |
| CVE-2005-1207 | HIGH 7.2 | microsoft windows_2003_server Buffer overflow in the Web Client service in Microsoft Windows XP and Windows Server 2003 allows remote authenticated users to execute arbitrary code via a crafted WebDAV request containing special parameters. | 7.3% | — |
| CVE-2024-25110 | CRIT 9.8 | microsoft azure_uamqp The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. U | 7.3% | — |
| CVE-2018-0940 | MED 6.5 | microsoft exchange_server Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack | 7.3% | — |