59.646 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.646 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-47012 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in siw_alloc_mr Our code analyzer reported a UAF. In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigne | 0.3% | — |
| CVE-2021-1054 | MED 5.5 | nvidia gpu_driver NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software does not perform or incorrectly performs an authorization check when an actor attempts to acce | 0.3% | — |
| CVE-2017-18224 | MED 4.7 | linux linux_kernel In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allows local users to cause a denial of service (BUG) by modifying a cert | 0.3% | — |
| CVE-2009-0935 | MED 5.5 | linux linux_kernel The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex t | 0.3% | — |
| CVE-2008-5182 | MED 6.9 | linux linux_kernel The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount. | 0.3% | — |
| CVE-2026-96243 | HIGH 7.8 | microsoft windows_10_1607 Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-53196 | MED 6.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), whic | 0.3% | — |
| CVE-2026-28723 | MED 4.3 | acronis cyber_protect Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | 0.3% | — |
| CVE-2026-28720 | MED 4.3 | acronis cyber_protect Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | 0.3% | — |
| CVE-2026-28719 | MED 4.3 | acronis cyber_protect Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | 0.3% | — |
| CVE-2026-28709 | MED 4.3 | acronis cyber_protect Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | 0.3% | — |
| CVE-2026-20076 | MED 4.8 | cisco identity_services_engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to i | 0.3% | — |
| CVE-2026-20047 | MED 4.8 | cisco identity_services_engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the i | 0.3% | — |
| CVE-2026-12462 | HIGH 7.5 | google chrome Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-11643 | HIGH 8.1 | google chrome Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2025-62675 | LOW 3.4 | fortinet fortios An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiPro | 0.3% | — |
| CVE-2025-27367 | MED 5.3 | ibm openpages_with_watson IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the | 0.3% | — |
| CVE-2025-21764 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF. | 0.3% | — |
| CVE-2025-11219 | LOW 3.1 | google chrome Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low) | 0.3% | — |
| CVE-2025-11198 | HIGH 7.4 | juniper security_director_policy_enforcer A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deploymen | 0.3% | — |
| CVE-2024-57901 | HIGH 7.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_protocol_dgram() to not touch skb at all, s | 0.3% | — |
| CVE-2024-53164 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen _before_ a call to said function because otherwise it may fail to notify | 0.3% | — |
| CVE-2024-46803 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check debug trap enable before write dbg_ev_file In interrupt context, write dbg_ev_file will be run by work queue. It will cause write dbg_ev_file execution after debug_trap_dis | 0.3% | — |
| CVE-2024-41001 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: work around a potential audit memory leak kmemleak complains that there's a memory leak related to connect handling: unreferenced object 0xffff0001093bdf00 (size 128): comm | 0.3% | — |
| CVE-2024-40998 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() In the following concurrency we will access the uninitialized rs->lock: ext4_fill_super ext4_register_sysfs | 0.3% | — |