59.422 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.422 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2010-1283 | HIGH 8.8 | adobe shockwave_player Adobe Shockwave Player before 11.5.7.609 does not properly parse 3D objects in .dir (aka Director) files, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a modified field in a 0xFFFFFF49 record. | 6.3% | — |
| CVE-2018-8422 | MED 6.5 | microsoft windows_7 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2008 R2. This CVE ID is unique from CV | 6.3% | — |
| CVE-2016-4163 | CRIT 9.8 | adobe air_desktop_runtime Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different v | 6.3% | — |
| CVE-2016-4162 | CRIT 9.8 | adobe air_desktop_runtime Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different v | 6.3% | — |
| CVE-2016-4161 | CRIT 9.8 | adobe air_desktop_runtime Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different v | 6.3% | — |
| CVE-2016-4160 | CRIT 9.8 | adobe air_desktop_runtime Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different v | 6.3% | — |
| CVE-2016-4120 | CRIT 9.8 | adobe air_desktop_runtime Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different v | 6.3% | — |
| CVE-2024-38014 | HIGH 7.8 | microsoft windows_10_1507 Windows Installer Elevation of Privilege Vulnerability | 6.3% | |
| CVE-2019-5021 | CRIT 9.8 | f5 big-ip_controller Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using af | 6.3% | — |
| CVE-2017-2994 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution. | 6.3% | — |
| CVE-2015-7663 | HIGH 10.0 | adobe air Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 a | 6.3% | — |
| CVE-2019-12406 | MED 6.5 | apache cxf Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of me | 6.3% | — |
| CVE-2016-3220 | HIGH 7.8 | microsoft windows_10 atmfd.dll in the Adobe Type Manager Font Driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges | 6.3% | — |
| CVE-2015-2944 | MED 4.3 | apache sling_api Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlRespons | 6.3% | — |
| CVE-2017-13798 | HIGH 8.8 | apple icloud An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKi | 6.3% | — |
| CVE-2023-35644 | HIGH 7.8 | microsoft windows_10_1809 Windows Sysmain Service Elevation of Privilege Vulnerability | 6.3% | — |
| CVE-2018-8234 | MED 4.3 | microsoft edge An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-0871. | 6.3% | — |
| CVE-2018-0871 | MED 4.3 | microsoft edge An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8234. | 6.3% | — |
| CVE-1999-0579 | HIGH 10.0 | microsoft windows_nt A Windows NT system's registry audit policy does not log an event success or failure for non-critical registry keys. | 6.2% | — |
| CVE-1999-0577 | HIGH 10.0 | microsoft windows_nt A Windows NT system's file audit policy does not log an event success or failure for non-critical files or directories. | 6.2% | — |
| CVE-2022-22034 | HIGH 7.8 | microsoft windows_10 Windows Graphics Component Elevation of Privilege Vulnerability | 6.2% | — |
| CVE-2024-52316 | CRIT 9.8 | apache tomcat Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an | 6.2% | — |
| CVE-2016-6992 | HIGH 8.8 | adobe flash_player Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion." | 6.2% | — |
| CVE-2016-4974 | HIGH 7.5 | apache amqp_0-x_jms_client Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and ex | 6.2% | — |
| CVE-2001-0147 | HIGH 10.0 | microsoft windows_2000 Buffer overflow in Windows 2000 event viewer snap-in allows attackers to execute arbitrary commands via a malformed field that is improperly handled during the detailed view of event records. | 6.2% | — |