56.571 CVE tracked
773 Exploited now
181 Used by ransomware
Last sync
CVE Tracker
56.571 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-5405 | MED 6.5 | vmware spring_cloud_config Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a | 68.8% | — |
| CVE-2017-8670 | HIGH 7.5 | microsoft edge Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, | 68.7% | — |
| CVE-2004-0567 | HIGH 7.5 | microsoft windows_2000 The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers | 68.7% | — |
| CVE-2016-3393 | HIGH 7.8 | microsoft windows_10_1507 Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute | 68.7% | |
| CVE-2015-7611 | HIGH 8.1 | apache james_server Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors. | 68.6% | — |
| CVE-2023-36757 | HIGH 8.0 | microsoft exchange_server Microsoft Exchange Server Spoofing Vulnerability | 68.6% | — |
| CVE-2021-21983 | MED 6.5 | vmware cloud_foundation Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying p | 68.6% | — |
| CVE-2017-11893 | HIGH 7.5 | microsoft chakracore ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory | 68.5% | — |
| CVE-2015-3628 | HIGH 9.0 | f5 big-ip_access_policy_manager The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, | 68.5% | — |
| CVE-2001-0537 | HIGH 9.3 | cisco ios HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. | 68.5% | — |
| CVE-2023-50290 | MED 6.5 | apache solr Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, | 68.4% | — |
| CVE-2020-13942 | CRIT 9.8 | apache unomi It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly | 68.4% | — |
| CVE-2015-7645 | HIGH 7.8 | ransomware adobe flash_player Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015. | 68.4% | |
| CVE-2012-0182 | HIGH 9.3 | microsoft word Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "Word PAPX Section Corruption Vulnerability." | 68.3% | — |
| CVE-2019-0626 | CRIT 9.8 | microsoft windows_10 A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'. | 68.3% | — |
| CVE-2021-26691 | CRIT 9.8 | apache http_server In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow | 68.3% | — |
| CVE-2018-8355 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is | 68.2% | — |
| CVE-2024-30088 | HIGH 7.0 | ransomware microsoft windows_10_1507 Windows Kernel Elevation of Privilege Vulnerability | 68.2% | |
| CVE-2019-1166 | MED 5.9 | microsoft windows_10 A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'. | 68.1% | — |
| CVE-2011-0654 | HIGH 10.0 | microsoft windows_2003_server Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Window | 68.1% | — |
| CVE-2006-1359 | HIGH 9.3 | microsoft ie Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | 68.1% | — |
| CVE-2017-11809 | HIGH 7.5 | microsoft chakracore ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Eng | 68.0% | — |
| CVE-2019-13373 | CRIT 9.8 | dlink central_wifimanager An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL. | 68.0% | — |
| CVE-2022-0435 | HIGH 8.8 | fedoraproject fedora A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system | 68.0% | — |
| CVE-2022-34713 | HIGH 7.8 | microsoft windows_10_1507 Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | 68.0% |