57.056 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
57.056 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-9599 | HIGH 7.5 | adobe acrobat_dc Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 3.5% | — |
| CVE-2009-3623 | HIGH 7.8 | linux linux_kernel The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, which allows remote attackers to cause a d | 3.5% | — |
| CVE-2005-4836 | HIGH 7.8 | apache tomcat The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information. | 3.5% | — |
| CVE-2016-9192 | HIGH 7.8 | cisco anyconnect_secure_mobility_client A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. More In | 3.5% | — |
| CVE-2006-5158 | HIGH 7.5 | canonical ubuntu_linux The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a de | 3.5% | — |
| CVE-2018-15441 | CRIT 9.4 | cisco prime_license_manager A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An a | 3.5% | — |
| CVE-2001-1519 | LOW 3.6 | microsoft windows_2000 RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrati | 3.5% | — |
| CVE-2009-4308 | HIGH 7.1 | linux linux_kernel The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted | 3.5% | — |
| CVE-2021-34848 | HIGH 7.8 | foxit pdf_reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 3.5% | — |
| CVE-2021-34831 | HIGH 7.8 | foxit pdf_reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.4.37651. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The | 3.5% | — |
| CVE-2018-0467 | HIGH 8.6 | cisco ios_xe A vulnerability in the IPv6 processing code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect handling of specific IPv6 hop-by-hop options. An attacker could ex | 3.5% | — |
| CVE-2024-21754 | LOW 1.8 | fortinet fortios A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2. | 3.5% | — |
| CVE-2021-30621 | MED 6.5 | fedoraproject fedora Chromium: CVE-2021-30621 UI Spoofing in Autofill | 3.5% | — |
| CVE-2021-30619 | MED 6.5 | fedoraproject fedora Chromium: CVE-2021-30619 UI Spoofing in Autofill | 3.5% | — |
| CVE-2009-5159 | MED 6.1 | invisioncommunity invision_power_board Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment. | 3.5% | — |
| CVE-2008-5534 | HIGH 9.3 | eset nod32_antivirus ESET NOD32 Antivirus 3662 and possibly 3440, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no | 3.5% | — |
| CVE-2021-21101 | HIGH 8.8 | adobe illustrator Adobe Illustrator version 25.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the curr | 3.5% | — |
| CVE-2021-1679 | MED 6.5 | microsoft windows_10 Windows CryptoAPI Denial of Service Vulnerability | 3.5% | — |
| CVE-2012-2972 | MED 5.0 | The (1) server and (2) agent components in CA ARCserve Backup r12.5, r15, and r16 on Windows do not properly validate RPC requests, which allows remote attackers to cause a denial of service (service crash) via a crafted request. | 3.5% | — |
| CVE-2022-39327 | HIGH 8.1 | microsoft azure_command-line_interface Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have b | 3.5% | — |
| CVE-2021-26885 | HIGH 7.8 | microsoft windows_10 Windows WalletService Elevation of Privilege Vulnerability | 3.5% | — |
| CVE-2018-8326 | MED 5.4 | microsoft web_customizations A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Open Source Customizatio | 3.5% | — |
| CVE-2015-2524 | HIGH 7.2 | microsoft windows_10 Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Eleva | 3.5% | — |
| CVE-2019-1008 | MED 5.9 | microsoft dynamics_365 A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'. | 3.5% | — |
| CVE-2015-2366 | HIGH 7.2 | microsoft windows_7 win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elev | 3.5% | — |