56.855 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.855 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2009-2653 | MED 4.6 | microsoft windows_server_2003 The NtUserConsoleControl function in win32k.sys in Microsoft Windows XP SP2 and SP3, and Server 2003 before SP1, allows local administrators to bypass unspecified "security software" and gain privileges via a crafted call that triggers an overwrite of an arbit | 5.9% | — |
| CVE-2018-0855 | MED 4.3 | microsoft windows_7 The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vu | 5.9% | — |
| CVE-2018-0847 | MED 4.3 | microsoft internet_explorer Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how Internet Explore | 5.9% | — |
| CVE-2017-11844 | MED 4.3 | microsoft edge Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further compromise the user's system, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure | 5.9% | — |
| CVE-2017-11803 | MED 4.3 | microsoft edge Microsoft Edge in Microsoft Windows 10 1703, 1709 and Windows Server, version 1709 allows an attacker to obtain information to further compromise the user's system, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure | 5.9% | — |
| CVE-2013-2172 | MED 4.3 | apache santuario_xml_security_for_java jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify a | 5.9% | — |
| CVE-2016-0983 | HIGH 8.8 | adobe air_desktop_runtime Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20. | 5.9% | — |
| CVE-2016-0982 | HIGH 8.8 | adobe air_desktop_runtime Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20. | 5.9% | — |
| CVE-2014-0648 | HIGH 10.0 | cisco secure_access_control_system The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCu | 5.9% | — |
| CVE-2003-0647 | HIGH 7.5 | cisco ios Buffer overflow in the HTTP server for Cisco IOS 12.2 and earlier allows remote attackers to execute arbitrary code via an extremely long (2GB) HTTP GET request. | 5.9% | — |
| CVE-2020-1239 | HIGH 8.8 | microsoft windows_10 A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1238. | 5.9% | — |
| CVE-2024-30279 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a | 5.9% | — |
| CVE-2020-0607 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'. | 5.9% | — |
| CVE-2009-5005 | MED 5.0 | apache qpid The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data. | 5.9% | — |
| CVE-2001-0346 | MED 5.0 | microsoft windows_2000 Handle leak in Microsoft Windows 2000 telnet service allows attackers to cause a denial of service by starting a large number of sessions and terminating them. | 5.9% | — |
| CVE-2014-4667 | MED 5.0 | canonical ubuntu_linux The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. | 5.9% | — |
| CVE-1999-0560 | HIGH 10.0 | microsoft windows_nt A system-critical Windows NT file or directory has inappropriate permissions. | 5.9% | — |
| CVE-1999-0226 | HIGH 10.0 | microsoft windows_nt Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service. | 5.9% | — |
| CVE-2011-2445 | HIGH 10.0 | adobe adobe_air Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corru | 5.9% | — |
| CVE-2010-2999 | HIGH 9.3 | realnetworks realplayer Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corru | 5.9% | — |
| CVE-2025-60724 | CRIT 9.8 | microsoft 365_copilot Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | 5.9% | — |
| CVE-2010-3854 | MED 4.3 | apache couchdb Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 5.9% | — |
| CVE-2007-6704 | LOW 2.6 | f5 firepass_4100 Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activa | 5.9% | — |
| CVE-1999-0292 | MED 5.0 | microsoft windows_nt Denial of service through Winpopup using large user names. | 5.9% | — |
| CVE-1999-0275 | MED 5.0 | microsoft windows_nt Denial of service in Windows NT DNS servers by flooding port 53 with too many characters. | 5.9% | — |