59.289 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.289 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-36314 | MED 5.5 | mozilla firefox When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.<br>This bug only affects Firefox for Windows. Other operating systems are unaffected.*. | 0.2% | — |
| CVE-2022-34675 | MED 5.5 | nvidia cloud_gaming NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference, which may lead to denial of service. | 0.2% | — |
| CVE-2022-20661 | MED 4.6 | cisco ios Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent d | 0.2% | — |
| CVE-2022-0021 | LOW 3.3 | paloaltonetworks globalprotect An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue imp | 0.2% | — |
| CVE-2021-47670 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_ | 0.2% | — |
| CVE-2021-47567 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: powerpc/32: Fix hardlockup on vmap stack overflow Since the commit c118c7303ad5 ("powerpc/32: Fix vmap stack - Do not activate MMU before reading task struct") a vmap stack overflow results | 0.2% | — |
| CVE-2021-47465 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle_kvm_start_guest(). T | 0.2% | — |
| CVE-2021-47226 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer Both Intel and AMD consider it to be architecturally valid for XRSTOR to fail with #PF but nonetheless change the regis | 0.2% | — |
| CVE-2021-43066 | HIGH 8.4 | fortinet forticlient A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer. | 0.2% | — |
| CVE-2021-38959 | MED 5.5 | ibm spss_statistics IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system. IBM X-Force ID: 212046. | 0.2% | — |
| CVE-2021-36170 | LOW 3.2 | fortinet fortianalyzer An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext. | 0.2% | — |
| CVE-2021-28821 | HIGH 8.8 | tibco enterprise_message_service The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability that theoretically allows a lo | 0.2% | — |
| CVE-2026-9975 | HIGH 8.3 | google chrome Out of bounds read and write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-96313 | HIGH 7.0 | microsoft windows_10_1809 Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-85328 | HIGH 7.0 | microsoft windows_10_1809 Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. | 0.2% | — |
| CVE-2026-59298 | LOW 3.1 | vmware spring_cloud_function Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier | 0.2% | — |
| CVE-2026-5895 | MED 5.4 | google chrome Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. (Chromium security severity: Low) | 0.2% | — |
| CVE-2026-55144 | HIGH 7.1 | microsoft windows_11_24h2 Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally. | 0.2% | — |
| CVE-2026-48287 | HIGH 7.4 | adobe c2pa CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires use | 0.2% | — |
| CVE-2026-47825 | HIGH 8.6 | vmware spring_cloud_gateway Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spr | 0.2% | — |
| CVE-2026-34193 | MED 4.3 | imaginationtech ddk Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host (Kernel) to perform a | 0.2% | — |
| CVE-2026-13024 | MED 4.2 | google chrome Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-12012 | HIGH 8.1 | google chrome Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-11658 | MED 6.5 | google chrome Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-11653 | MED 6.5 | google chrome Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |