59.703 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.703 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-0004 | HIGH 7.2 | microsoft windows_7 The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain p | 3.6% | — |
| CVE-1999-0468 | HIGH 8.2 | microsoft internet_explorer Internet Explorer 5.0 allows a remote server to read arbitrary files on the client's file system using the Microsoft Scriptlet Component. | 3.6% | — |
| CVE-2024-43560 | HIGH 7.8 | microsoft windows_10_1507 Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability | 3.6% | — |
| CVE-2016-4434 | HIGH 7.8 | apache tika Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other | 3.6% | — |
| CVE-2010-1087 | HIGH 7.8 | debian debian_linux The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible. | 3.6% | — |
| CVE-2021-31811 | MED 5.5 | apache pdfbox In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions. | 3.6% | — |
| CVE-2023-24912 | HIGH 7.8 | microsoft windows_10_1507 Windows Graphics Component Elevation of Privilege Vulnerability | 3.6% | — |
| CVE-2017-4933 | HIGH 8.8 | vmware esxi VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap co | 3.6% | — |
| CVE-2014-0618 | HIGH 7.8 | juniper junos Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to | 3.6% | — |
| CVE-1999-0071 | HIGH 7.5 | apache http_server Apache httpd cookie buffer overflow for versions 1.1.1 and earlier. | 3.6% | — |
| CVE-2021-26433 | HIGH 7.5 | microsoft windows_10 Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability | 3.6% | — |
| CVE-2021-26415 | HIGH 7.8 | microsoft windows_10 Windows Installer Elevation of Privilege Vulnerability | 3.6% | — |
| CVE-2016-4929 | HIGH 8.8 | juniper junos_space Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. | 3.6% | — |
| CVE-2020-9661 | HIGH 7.8 | adobe after_effects Adobe After Effects versions 17.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution . | 3.6% | — |
| CVE-2020-1487 | HIGH 7.8 | microsoft windows_10 An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability | 3.6% | — |
| CVE-2019-1865 | HIGH 8.8 | cisco integrated_management_controller_supervisor A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerab | 3.6% | — |
| CVE-2017-15718 | CRIT 9.8 | apache hadoop The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications. | 3.6% | — |
| CVE-2019-8054 | MED 4.3 | adobe acrobat_dc Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploi | 3.6% | — |
| CVE-2019-8053 | MED 4.3 | adobe acrobat_dc Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploi | 3.6% | — |
| CVE-2012-3324 | HIGH 9.0 | ibm db2 Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows remote authenticated users to modify, delete, or read arbitrary files via a pathname in the file field. | 3.6% | — |
| CVE-2017-6648 | HIGH 7.5 | cisco telepresence_ce_software A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, remote attacker to cause a TelePresence endpoint to reload unexpectedly, resulting in a denia | 3.6% | — |
| CVE-2014-2842 | HIGH 7.8 | juniper screenos Juniper ScreenOS 6.3 and earlier allows remote attackers to cause a denial of service (crash and restart or failover) via a malformed SSL/TLS packet. | 3.6% | — |
| CVE-2011-0253 | HIGH 9.3 | apple safari WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2 | 3.6% | — |
| CVE-2011-0240 | HIGH 9.3 | apple safari WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2 | 3.6% | — |
| CVE-2011-0237 | HIGH 9.3 | apple safari WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2 | 3.6% | — |