56.960 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.960 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2008-5821 | MED 5.0 | apple safari Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause a denial of service (memory consumption and browser crash) via a long ALINK attribute in a BODY element in an HTML document. | 3.9% | — |
| CVE-2019-15538 | HIGH 7.5 | canonical ubuntu_linux An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_ | 3.9% | — |
| CVE-2025-30388 | HIGH 7.8 | microsoft 365_copilot Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally. | 3.9% | — |
| CVE-2019-12399 | HIGH 7.5 | apache kafka When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a conn | 3.9% | — |
| CVE-2017-5970 | HIGH 7.5 | linux linux_kernel The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP optio | 3.9% | — |
| CVE-2006-1476 | LOW 2.6 | microsoft windows_xp Windows Firewall in Microsoft Windows XP SP2 produces incorrect application block alerts when the application filename is ".exe" (with no characters before the "."), which might allow local user-assisted users to trick a user into unblocking a Trojan horse pro | 3.9% | — |
| CVE-2023-38709 | HIGH 7.3 | apache http_server Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. | 3.9% | — |
| CVE-2008-4308 | LOW 2.6 | apache tomcat The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request. | 3.9% | — |
| CVE-2005-2242 | MED 5.0 | Cisco CallManager (CCM) 3.2 and earlier, 3.3 before 3.3(5), 4.0 before 4.0(2a)SR2b, and 4.1 4.1 before 4.1(3)SR1 allows remote attackers to cause a denial of service (memory consumption and restart) via crafted packets to (1) the CTI Manager (ctimgr.exe) or (2 | 3.9% | — |
| CVE-2014-0516 | HIGH 7.5 | adobe adobe_air Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow remote attackers to bypass the Same Origin Policy via unspecified vectors. | 3.9% | — |
| CVE-2008-3691 | HIGH 10.0 | vmware ace Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware A | 3.9% | — |
| CVE-2003-0007 | MED 5.0 | microsoft outlook Microsoft Outlook 2002 does not properly handle requests to encrypt email messages with V1 Exchange Server Security certificates, which causes Outlook to send the email in plaintext, aka "Flaw in how Outlook 2002 handles V1 Exchange Server Security Certificate | 3.9% | — |
| CVE-2018-8214 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows Desktop Bridge Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. Th | 3.9% | — |
| CVE-2020-9680 | HIGH 8.8 | adobe prelude Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 3.9% | — |
| CVE-2020-3779 | HIGH 8.8 | adobe photoshop_2020 Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 3.9% | — |
| CVE-2020-3773 | HIGH 8.8 | adobe photoshop_2020 Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 3.9% | — |
| CVE-2020-3732 | HIGH 8.8 | adobe framemaker Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 3.9% | — |
| CVE-2020-3730 | HIGH 8.8 | adobe framemaker Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 3.9% | — |
| CVE-2020-3729 | HIGH 8.8 | adobe framemaker Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 3.9% | — |
| CVE-2020-3727 | HIGH 8.8 | adobe framemaker Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 3.9% | — |
| CVE-2020-3722 | HIGH 8.8 | adobe framemaker Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 3.9% | — |
| CVE-2020-9494 | HIGH 7.5 | apache traffic_server Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread. | 3.9% | — |
| CVE-2008-2054 | HIGH 9.3 | cisco ciscoworks_common_services Unspecified vulnerability in Cisco CiscoWorks Common Services 3.0.3 through 3.1.1 allows remote attackers to execute arbitrary code on a client machine via unknown vectors. | 3.9% | — |
| CVE-2018-0274 | HIGH 8.8 | cisco network_services_orchestrator A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insufficient input validation. An | 3.9% | — |
| CVE-2016-1006 | HIGH 8.1 | adobe air_desktop_runtime Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass the ASLR protection mechanism via JIT data. | 3.9% | — |