59.646 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.646 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-24985 | HIGH 7.8 | microsoft windows_10_1507 Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. | 3.9% | |
| CVE-2010-4251 | HIGH 7.5 | linux linux_kernel The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, | 3.9% | — |
| CVE-2017-8633 | HIGH 7.5 | microsoft windows_10 Windows Error Reporting (WER) in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability, aka "Wi | 3.9% | — |
| CVE-2021-1716 | HIGH 7.8 | microsoft 365_apps Microsoft Word Remote Code Execution Vulnerability | 3.9% | — |
| CVE-2021-1715 | HIGH 7.8 | microsoft 365_apps Microsoft Word Remote Code Execution Vulnerability | 3.9% | — |
| CVE-2018-17700 | HIGH 8.8 | foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 3.9% | — |
| CVE-2016-15057 | CRIT 9.9 | apache continuum ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can | 3.9% | — |
| CVE-2021-1264 | CRIT 9.6 | cisco catalyst_center A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit | 3.9% | — |
| CVE-2019-13325 | HIGH 7.8 | foxitsoftware foxit_studio_photo This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 3.9% | — |
| CVE-2004-0263 | MED 5.0 | apache http_server PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information. | 3.9% | — |
| CVE-2003-1157 | MED 4.3 | citrix metaframe Cross-site scripting (XSS) vulnerability in login.asp in Citrix MetaFrame XP Server 1.0 allows remote attackers to inject arbitrary web script or HTML via the NFuse_Message parameter. | 3.9% | — |
| CVE-2022-21880 | HIGH 7.5 | microsoft windows_10 Windows GDI+ Information Disclosure Vulnerability | 3.9% | — |
| CVE-2018-10141 | MED 6.1 | paloaltonetworks pan-os GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML. | 3.9% | — |
| CVE-2015-2518 | MED 6.9 | microsoft windows_10 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted appli | 3.9% | — |
| CVE-2015-2511 | MED 6.9 | microsoft windows_10 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted appli | 3.9% | — |
| CVE-2021-21102 | HIGH 8.8 | adobe illustrator Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current us | 3.9% | — |
| CVE-2020-17022 | HIGH 7.8 | microsoft windows_10 <p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code.</p> <p>Exploitation of the vulnerability requires | 3.9% | — |
| CVE-2020-1252 | HIGH 7.8 | microsoft windows_10 <p>A remote code execution vulnerability exists when Windows improperly handles objects in memory. To exploit the vulnerability an attacker would have to convince a user to run a specially crafted application.</p> <p>An attacker who successfully exploited this | 3.9% | — |
| CVE-2011-0622 | HIGH 9.3 | adobe flash_player Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than | 3.9% | — |
| CVE-2011-0621 | HIGH 9.3 | adobe flash_player Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than | 3.9% | — |
| CVE-2011-0620 | HIGH 9.3 | adobe flash_player Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than | 3.9% | — |
| CVE-2011-0619 | HIGH 9.3 | adobe flash_player Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than | 3.9% | — |
| CVE-2019-1218 | MED 5.4 | microsoft outlook A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfu | 3.9% | — |
| CVE-2002-1895 | MED 5.0 | apache tomcat The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN. | 3.9% | — |
| CVE-2012-0384 | HIGH 7.2 | cisco ios Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG and 3.2.xSG before 3.2.2SG, when AAA authorization is enabled, allow remote authen | 3.9% | — |