57.056 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.056 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-59320 | MED 6.5 | vmware spring_advanced_message_queuing_protocol When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and | 0.3% | — |
| CVE-2026-5884 | HIGH 8.8 | google chrome Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medi | 0.3% | — |
| CVE-2026-5883 | HIGH 8.8 | google chrome Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2026-48354 | MED 6.2 | adobe c2pa CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Explo | 0.3% | — |
| CVE-2026-4444 | HIGH 8.8 | google chrome Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-3543 | HIGH 8.8 | google chrome Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-24216 | HIGH 7.8 | nvidia bionemo_framework NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering. | 0.3% | — |
| CVE-2026-14122 | HIGH 8.1 | google chrome Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low) | 0.3% | — |
| CVE-2025-55340 | HIGH 7.0 | microsoft windows_10_21h2 Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2025-20302 | MED 4.3 | cisco secure_firewall_management_center A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a generated report from a different domain. This vulnerability is due to missing authorization check | 0.3% | — |
| CVE-2024-53239 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might | 0.3% | — |
| CVE-2024-49960 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed mount Syzbot has found an ODEBUG bug in ext4_fill_super The del_timer_sync function cancels the s_err_report timer, which reminds about filesystem e | 0.3% | — |
| CVE-2024-47742 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers o | 0.3% | — |
| CVE-2024-46740 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied a | 0.3% | — |
| CVE-2024-40995 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to a | 0.3% | — |
| CVE-2024-39506 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value, but then it is unconditionally passed to skb_ad | 0.3% | — |
| CVE-2024-30388 | MED 6.5 | juniper junos An Improper Isolation or Compartmentalization vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on QFX5000 Series and EX Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). If a specific malfo | 0.3% | — |
| CVE-2024-27078 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpg_alloc In tpg_alloc, resources should be deallocated in each and every error-handling paths, since they are allocated in for statements. Otherwise th | 0.3% | — |
| CVE-2024-27077 | MED 5.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity but isn't freed in its following error-handling paths. Th | 0.3% | — |
| CVE-2024-27076 | MED 5.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak Free the memory allocated in v4l2_ctrl_handler_init on release. | 0.3% | — |
| CVE-2024-27074 | MED 5.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134 | 0.3% | — |
| CVE-2024-26601 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_b | 0.3% | — |
| CVE-2024-20713 | MED 5.5 | adobe substance_3d_stager Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this i | 0.3% | — |
| CVE-2024-20712 | MED 5.5 | adobe substance_3d_stager Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this i | 0.3% | — |
| CVE-2024-20711 | MED 5.5 | adobe substance_3d_stager Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this i | 0.3% | — |