57.023 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
57.023 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-0718 | HIGH 8.8 | microsoft windows_server_2008 <p>A remote code execution vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Accou | 3.6% | — |
| CVE-2019-19060 | HIGH 7.5 | broadcom brocade_fabric_operating_system_firmware A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41. | 3.6% | — |
| CVE-2025-69258 | CRIT 9.8 | trendmicro apex_central A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installati | 3.6% | — |
| CVE-2020-12247 | HIGH 7.1 | foxitsoftware phantompdf In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur. | 3.6% | — |
| CVE-2011-3251 | HIGH 9.3 | apple quicktime Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted TKHD atoms in a QuickTime movie file. | 3.6% | — |
| CVE-2018-4190 | HIGH 8.8 | apple icloud An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKi | 3.6% | — |
| CVE-2001-0760 | MED 5.0 | citrix nfuse Citrix Nfuse 1.51 allows remote attackers to obtain the absolute path of the web root via a malformed request to launch.asp that does not provide the session field. | 3.6% | — |
| CVE-2021-40745 | HIGH 7.5 | adobe campaign Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server. | 3.6% | — |
| CVE-2018-0310 | CRIT 9.8 | cisco firepower_extensible_operating_system A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to obtain sensitive information from memory or cause a denial of service (DoS) condition on the affected prod | 3.6% | — |
| CVE-2023-21688 | HIGH 7.8 | microsoft windows_10_1507 NT OS Kernel Elevation of Privilege Vulnerability | 3.6% | — |
| CVE-2018-11767 | HIGH 7.4 | apache hadoop In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms. | 3.6% | — |
| CVE-2010-1086 | HIGH 7.8 | debian debian_linux The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame, related to an invalid Payload Pointer ULE. | 3.6% | — |
| CVE-2014-2198 | HIGH 10.0 | cisco unified_cdm_platform_software Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the support and root accounts by extracting this key from a binary f | 3.6% | — |
| CVE-2013-6979 | MED 5.4 | cisco ios_xe The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configuration, which allows remote attackers to bypass authentication by leveraging access to a 192.168.x.2 source IP address, | 3.6% | — |
| CVE-2025-20303 | MED 5.4 | cisco identity_services_engine Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient vali | 3.6% | — |
| CVE-2014-0524 | HIGH 10.0 | adobe acrobat Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0522, CVE-2014- | 3.6% | — |
| CVE-2014-0522 | HIGH 10.0 | adobe acrobat Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0523, CVE-2014- | 3.6% | — |
| CVE-2021-1716 | HIGH 7.8 | microsoft 365_apps Microsoft Word Remote Code Execution Vulnerability | 3.6% | — |
| CVE-2021-1715 | HIGH 7.8 | microsoft 365_apps Microsoft Word Remote Code Execution Vulnerability | 3.6% | — |
| CVE-2019-0570 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2 | 3.6% | — |
| CVE-2017-6652 | HIGH 7.5 | cisco telepresence_ix5000 A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit t | 3.6% | — |
| CVE-2017-5636 | CRIT 9.8 | apache nifi In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a repl | 3.6% | — |
| CVE-2014-0581 | HIGH 10.0 | adobe air Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execu | 3.6% | — |
| CVE-2014-0576 | HIGH 10.0 | adobe air Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execu | 3.6% | — |
| CVE-2018-20732 | CRIT 9.8 | sas web_infrastructure_platform SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant. | 3.6% | — |