57.056 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.056 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-6755 | HIGH 7.8 | foxitsoftware foxit_reader This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The | 3.5% | — |
| CVE-2019-12405 | CRIT 9.8 | apache traffic_control Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as t | 3.5% | — |
| CVE-2017-8754 | MED 4.2 | microsoft edge Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page containing malicious content, due to the way that the Edge Content Security Policy (CSP) validates certain specially c | 3.5% | — |
| CVE-2021-41616 | CRIT 9.8 | apache ddlutils Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was inse | 3.5% | — |
| CVE-2018-8564 | MED 4.3 | microsoft edge A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft Edge. | 3.5% | — |
| CVE-2007-3380 | MED 5.0 | linux linux_kernel The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port, which probably prevents other processes from accessing the service. | 3.5% | — |
| CVE-2000-0232 | LOW 2.1 | microsoft terminal_server Microsoft TCP/IP Printing Services, aka Print Services for Unix, allows an attacker to cause a denial of service via a malformed TCP/IP print request. | 3.5% | — |
| CVE-2000-1210 | MED 5.0 | apache tomcat Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. | 3.5% | — |
| CVE-2026-20843 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | 3.5% | — |
| CVE-2020-1992 | HIGH 8.1 | paloaltonetworks pan-os A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the daemon creating a denial of service condition or potentially execute code with root privileges. This i | 3.5% | — |
| CVE-2019-6751 | HIGH 7.8 | foxitsoftware foxit_studio_photo This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.779. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file | 3.5% | — |
| CVE-2019-6750 | HIGH 7.8 | foxitsoftware foxit_studio_photo This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Th | 3.5% | — |
| CVE-2019-6749 | HIGH 7.8 | foxitsoftware foxit_studio_photo This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Th | 3.5% | — |
| CVE-2019-1894 | HIGH 7.2 | cisco enterprise_nfv_infrastructure_software A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite or read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerab | 3.5% | — |
| CVE-2019-1804 | CRIT 9.8 | cisco nexus_93108tc-ex_firmware A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user. The | 3.5% | — |
| CVE-2011-4185 | HIGH 10.0 | novell iprint The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2 | 3.5% | — |
| CVE-2018-8600 | MED 6.1 | microsoft azure_app_service_on_azure_stack A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site Scripting Vulnerability." This affects Azure App. | 3.5% | — |
| CVE-2026-33829 | MED 4.3 | microsoft windows_10_1607 Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network. | 3.4% | — |
| CVE-2007-6726 | MED 4.3 | apache struts Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.htm | 3.4% | — |
| CVE-2024-30103 | HIGH 8.8 | microsoft 365_apps Microsoft Outlook Remote Code Execution Vulnerability | 3.4% | — |
| CVE-2019-13398 | HIGH 7.2 | fortinet fcm-mb40_firmware Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi. | 3.4% | — |
| CVE-2005-0108 | MED 5.0 | apache mod_auth_radius Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument. | 3.4% | — |
| CVE-2021-31811 | MED 5.5 | apache pdfbox In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions. | 3.4% | — |
| CVE-2019-0234 | MED 6.1 | apache roller A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability | 3.4% | — |
| CVE-2018-11779 | CRIT 9.8 | apache storm In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class. | 3.4% | — |