60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.267 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-29105 | HIGH 7.8 | microsoft windows_10 Microsoft Windows Media Foundation Remote Code Execution Vulnerability | 2.8% | — |
| CVE-2012-0365 | HIGH 9.0 | cisco small_business_srp520-u_series_firmware Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arb | 2.8% | — |
| CVE-2003-0418 | MED 5.0 | linux linux_kernel The Linux 2.0 kernel IP stack does not properly calculate the size of an ICMP citation, which causes it to include portions of unauthorized memory in ICMP error responses. | 2.8% | — |
| CVE-2022-45462 | CRIT 9.8 | apache dolphinscheduler Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher | 2.8% | — |
| CVE-2020-1925 | HIGH 7.5 | apache olingo Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect t | 2.8% | — |
| CVE-2020-9617 | MED 5.5 | adobe premiere_rush Adobe Premiere Rush versions 1.5.8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2.8% | — |
| CVE-2017-12367 | CRIT 9.6 | cisco webex_meetings_server A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a | 2.8% | — |
| CVE-2010-4680 | HIGH 9.0 | cisco 5500_series_adaptive_security_appliance The WebVPN implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) permits the viewing of CIFS shares even when CIFS file browsing has been disabled, which allows remote authenticated users to bypass intended | 2.8% | — |
| CVE-2010-4675 | HIGH 9.0 | cisco 5500_series_adaptive_security_appliance Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) do not properly determine the interfaces for which TELNET connections should be permitted, which allows remote authenticated users to bypass intended access restrictions v | 2.8% | — |
| CVE-2009-1808 | MED 4.9 | microsoft windows_xp Microsoft Windows XP SP3 allows local users to cause a denial of service (system crash) by making an SPI_SETDESKWALLPAPER SystemParametersInfo call with an improperly terminated pvParam argument, followed by an SPI_GETDESKWALLPAPER SystemParametersInfo call. | 2.8% | — |
| CVE-2009-0634 | HIGH 7.1 | cisco cisco_ios Multiple unspecified vulnerabilities in the home agent (HA) implementation in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interf | 2.8% | — |
| CVE-2021-26881 | HIGH 7.5 | microsoft windows_10 Microsoft Windows Media Foundation Remote Code Execution Vulnerability | 2.8% | — |
| CVE-2022-24519 | MED 6.5 | microsoft azure_site_recovery Azure Site Recovery Elevation of Privilege Vulnerability | 2.8% | — |
| CVE-2022-24518 | MED 6.5 | microsoft azure_site_recovery Azure Site Recovery Elevation of Privilege Vulnerability | 2.8% | — |
| CVE-2022-24506 | MED 6.5 | microsoft azure_site_recovery Azure Site Recovery Elevation of Privilege Vulnerability | 2.8% | — |
| CVE-2021-34453 | HIGH 7.5 | microsoft exchange_server Microsoft Exchange Server Denial of Service Vulnerability | 2.8% | — |
| CVE-2020-4343 | HIGH 7.8 | ibm i2_analysts_notebook IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to execu | 2.8% | — |
| CVE-2020-1343 | MED 5.9 | microsoft visual_studio_live_share An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Share Information Disclosure Vulnerability'. | 2.8% | — |
| CVE-2021-42009 | MED 4.3 | apache traffic_control An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitra | 2.8% | — |
| CVE-2019-12398 | MED 4.8 | apache airflow In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected. | 2.8% | — |
| CVE-2015-4928 | MED 4.3 | apache ambari Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields. | 2.8% | — |
| CVE-2014-3352 | MED 4.3 | cisco cloud_portal Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, related to an | 2.8% | — |
| CVE-2013-4246 | HIGH 8.8 | apache subversion libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing packed revision properties. | 2.8% | — |
| CVE-2023-38232 | MED 5.5 | adobe acrobat Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations s | 2.8% | — |
| CVE-2013-5663 | MED 4.3 | paloaltonetworks pan-os The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identi | 2.8% | — |