59.703 CVE tracked
805 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
59.703 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-49249 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wc938x: fix accessing array out of bounds for enum type Accessing enums using integer would result in array out of bounds access on platforms like aarch64 where sizeof(long) is | 0.3% | — |
| CVE-2022-49236 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race between btf_try_get_module and load_module While working on code to populate kfunc BTF ID sets for module BTF from its initcall, I noticed that by the time the initc | 0.3% | — |
| CVE-2022-49196 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix use after free in remove_phb_dynamic() In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may | 0.3% | — |
| CVE-2022-49182 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is f | 0.3% | — |
| CVE-2022-49170 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg->alloc_type As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in fs | 0.3% | — |
| CVE-2022-49163 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: fix a bug of accessing array out of bounds When error occurs in parsing jpeg, the slot isn't acquired yet, it may be the default value MXC_MAX_SLOTS. If the driver access th | 0.3% | — |
| CVE-2022-48822 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: usb: f_fs: Fix use-after-free for epfile Consider a case where ffs_func_eps_disable is called from ffs_func_disable as part of composition switch and at the same time ffs_epfile_release get | 0.3% | — |
| CVE-2022-48818 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the | 0.3% | — |
| CVE-2022-48813 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slav | 0.3% | — |
| CVE-2021-29827 | MED 5.2 | ibm infosphere_information_server IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and | 0.3% | — |
| CVE-2021-1449 | MED 6.7 | cisco aironet_access_point_software A vulnerability in the boot logic of Cisco Access Points Software could allow an authenticated, local attacker to execute unsigned code at boot time. The vulnerability is due to an improper check that is performed by the area of code that manages system startu | 0.3% | — |
| CVE-2021-1447 | MED 6.7 | cisco content_security_management_appliance A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, local attacker to elevate their privileges to root. This vulnerability is due to a procedural flaw in the | 0.3% | — |
| CVE-2020-3504 | LOW 3.3 | cisco firepower_extensible_operating_system A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of CLI command | 0.3% | — |
| CVE-2020-25212 | HIGH 7.0 | canonical ubuntu_linux A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b93545 | 0.3% | — |
| CVE-2019-4652 | HIGH 7.1 | ibm spectrum_protect_plus IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963. | 0.3% | — |
| CVE-2019-1944 | HIGH 7.3 | cisco adaptive_security_appliance_software Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being established. Fo | 0.3% | — |
| CVE-2017-6694 | MED 5.5 | cisco ultra_services_platform A vulnerability in the Virtual Network Function Manager's (VNFM) logging function of Cisco Ultra Services Platform could allow an authenticated, local attacker to view sensitive data (cleartext credentials) on an affected system. More Information: CSCvd29355. | 0.3% | — |
| CVE-2017-6693 | MED 5.5 | cisco elastic_services_controller A vulnerability in the ConfD server component of Cisco Elastic Services Controllers could allow an authenticated, local attacker to access information stored in the file system of an affected system, aka Unauthorized Directory Access. More Information: CSCvd76 | 0.3% | — |
| CVE-2016-6130 | MED 4.7 | debian debian_linux Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability. | 0.3% | — |
| CVE-2026-83930 | HIGH 7.0 | microsoft windows_11_23h2 Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-77891 | MED 6.4 | microsoft windows_10_1607 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-77887 | MED 6.4 | microsoft windows_10_1607 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-73017 | HIGH 7.5 | microsoft windows_10_1809 Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-71338 | MED 6.4 | microsoft windows_10_1607 Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-70273 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.3% | — |