59.529 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.529 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2014-0504 | MED 5.0 | adobe flash_player Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows attackers to read the clipboard via unspecified vectors. | 4.2% | — |
| CVE-2023-32049 | HIGH 8.8 | microsoft windows_10_1607 Windows SmartScreen Security Feature Bypass Vulnerability | 4.2% | |
| CVE-2022-37967 | HIGH 7.2 | fedoraproject fedora Windows Kerberos Elevation of Privilege Vulnerability | 4.2% | — |
| CVE-2004-0883 | MED 6.4 | linux linux_kernel Multiple vulnerabilities in the samba filesystem (smbfs) in Linux kernel 2.4 and 2.6 allow remote samba servers to cause a denial of service (crash) or gain sensitive information from kernel memory via a samba server (1) returning more data than requested to t | 4.2% | — |
| CVE-2017-3080 | MED 6.5 | adobe flash_player Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used by Internet Explorer. Successful exploitation could lead to information disclosure. | 4.2% | — |
| CVE-2010-1421 | MED 4.3 | apple safari The execCommand JavaScript function in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly restrict remote execution of clipboard commands, which allows remote attackers to modify the | 4.2% | — |
| CVE-2019-0859 | HIGH 7.8 | ransomware microsoft windows_10_1507 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803. | 4.2% | |
| CVE-2016-5000 | MED 5.5 | apache poi The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | 4.2% | — |
| CVE-2019-8039 | HIGH 8.8 | adobe acrobat_dc Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploi | 4.2% | — |
| CVE-2019-6730 | HIGH 8.8 | foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific f | 4.2% | — |
| CVE-2019-6727 | HIGH 8.8 | foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific f | 4.2% | — |
| CVE-2019-19768 | HIGH 7.5 | linux linux_kernel In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer). | 4.2% | — |
| CVE-2014-3535 | HIGH 7.8 | linux linux_kernel include/linux/netdevice.h in the Linux kernel before 2.6.36 incorrectly uses macros for netdev_printk and its related logging implementation, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) by sending inva | 4.2% | — |
| CVE-2019-13398 | HIGH 7.2 | fortinet fcm-mb40_firmware Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi. | 4.1% | — |
| CVE-2006-2312 | LOW 2.6 | skype skype Argument injection vulnerability in the URI handler in Skype 2.0.*.104 and 2.5.*.0 through 2.5.*.78 for Windows allows remote authorized attackers to download arbitrary files via a URL that contains certain command-line switches. | 4.1% | — |
| CVE-2026-21533 | HIGH 7.8 | microsoft windows_10_1607 Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. | 4.1% | |
| CVE-2023-46804 | HIGH 7.5 | ivanti avalanche An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). | 4.1% | — |
| CVE-2023-46803 | HIGH 7.5 | ivanti avalanche An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). | 4.1% | — |
| CVE-2020-9749 | HIGH 7.8 | adobe animate Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .fla file | 4.1% | — |
| CVE-2020-9747 | HIGH 7.8 | adobe animate Adobe Animate version 20.5 (and earlier) is affected by a double free vulnerability when parsing a crafted .fla file, which could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit. | 4.1% | — |
| CVE-2018-8020 | HIGH 7.4 | apache tomcat_native Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, | 4.1% | — |
| CVE-2019-1255 | HIGH 7.5 | microsoft forefront_endpoint_protection_2010 A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'. | 4.1% | — |
| CVE-2022-41674 | HIGH 8.1 | debian debian_linux An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. | 4.1% | — |
| CVE-2021-30616 | HIGH 8.8 | fedoraproject fedora Chromium: CVE-2021-30616 Use after free in Media | 4.1% | — |
| CVE-2021-30609 | HIGH 8.8 | fedoraproject fedora Chromium: CVE-2021-30609 Use after free in Sign-In | 4.1% | — |