59.667 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.667 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-19230 | CRIT 9.8 | broadcom nolio An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code. | 3.8% | — |
| CVE-2007-0187 | HIGH 7.5 | f5 firepass F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letter | 3.8% | — |
| CVE-2021-42284 | MED 6.8 | microsoft windows_10 Windows Hyper-V Denial of Service Vulnerability | 3.8% | — |
| CVE-2006-5660 | HIGH 7.5 | cisco security_agent_management_center Cisco Security Agent Management Center (CSAMC) 5.1 before 5.1.0.79 does not properly handle certain LDAP error messages, which allows remote attackers to bypass authentication requirements via an empty password when using an external LDAP server. | 3.8% | — |
| CVE-2020-11976 | HIGH 7.5 | apache fortress By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions | 3.8% | — |
| CVE-2014-1209 | HIGH 9.3 | vmware vsphere_client VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors. | 3.8% | — |
| CVE-2008-0600 | HIGH 7.2 | linux linux_kernel The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer before dereference, which allows local users to gain root privileges via crafted arguments in a vmsplice system call, a different vulnerability | 3.8% | — |
| CVE-2018-0234 | HIGH 8.6 | cisco aironet_access_point_software A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810, 1830, and 1850 Series Access Points could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a den | 3.8% | — |
| CVE-2019-7999 | MED 6.5 | adobe photoshop_cc Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory leak. | 3.8% | — |
| CVE-2022-23271 | MED 6.5 | microsoft dynamics_gp Microsoft Dynamics GP Elevation Of Privilege Vulnerability | 3.8% | — |
| CVE-2019-19048 | HIGH 7.5 | canonical ubuntu_linux A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864. | 3.8% | — |
| CVE-2017-3160 | HIGH 7.4 | apache cordova After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle | 3.8% | — |
| CVE-2017-6758 | MED 6.5 | cisco unified_communications_manager A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is | 3.8% | — |
| CVE-2003-1604 | HIGH 7.5 | linux linux_kernel The redirect_target function in net/ipv4/netfilter/ipt_REDIRECT.c in the Linux kernel before 2.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending packets to an interface that has a 0.0.0.0 IP address, a rela | 3.8% | — |
| CVE-2014-7284 | MED 6.4 | linux linux_kernel The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers | 3.8% | — |
| CVE-2020-1024 | HIGH 8.8 | microsoft sharepoint_enterprise_server A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoin | 3.7% | — |
| CVE-2020-1023 | HIGH 8.8 | microsoft sharepoint_enterprise_server A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoin | 3.7% | — |
| CVE-2019-1188 | HIGH 7.5 | microsoft windows_10 A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accou | 3.7% | — |
| CVE-2021-35990 | HIGH 7.8 | adobe bridge Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current | 3.7% | — |
| CVE-2021-35989 | HIGH 7.8 | adobe bridge Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current | 3.7% | — |
| CVE-2019-1854 | MED 4.1 | cisco telepresence_video_communication_server A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web in | 3.7% | — |
| CVE-2017-3100 | MED 6.5 | adobe flash_player Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure. | 3.7% | — |
| CVE-2014-3501 | MED 4.3 | apache cordova Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView. | 3.7% | — |
| CVE-2013-5122 | CRIT 9.8 | cisco linksys_e4200_firmware Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access | 3.7% | — |
| CVE-2010-2959 | HIGH 7.2 | debian debian_linux Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a | 3.7% | — |