60.202 CVE tracked
808 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.202 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-23023 | HIGH 7.8 | f5 big-ip_access_policy_manager On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evalu | 0.3% | — |
| CVE-2020-5896 | HIGH 7.8 | f5 big-ip_access_policy_manager On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions. | 0.3% | — |
| CVE-2020-4623 | MED 6.5 | ibm i2_ibase IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code | 0.3% | — |
| CVE-2019-19151 | MED 5.5 | f5 big-ip_access_policy_manager On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell ( | 0.3% | — |
| CVE-2018-7995 | MED 4.7 | canonical ubuntu_linux Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devic | 0.3% | — |
| CVE-2017-12317 | MED 6.7 | cisco advanced_malware_protection The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vulnerability is due to the use of a static key value stored in the application used to encrypt the conne | 0.3% | — |
| CVE-2014-0684 | MED 4.6 | cisco nexus_7000 Cisco NX-OS 6.2(2) on Nexus 7000 switches allows local users to cause a denial of service via crafted sed input, aka Bug ID CSCui56136. | 0.3% | — |
| CVE-2013-1196 | MED 6.8 | cisco application_networking_manager The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime Network Control System, Prime LAN Management Solution (LMS), Prime Collaboration, Un | 0.3% | — |
| CVE-2013-1125 | MED 6.8 | cisco application_networking_manager The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution (LMS), Prime Network Control System, Quad, Context Directory Agent, Prime Collaborati | 0.3% | — |
| CVE-2012-4121 | MED 6.8 | cisco nx-os Cisco NX-OS allows local users to gain privileges, and read or modify arbitrary files, via the sed (1) r and (2) w commands, aka Bug IDs CSCts56559, CSCts56565, CSCts56570, and CSCts56574. | 0.3% | — |
| CVE-2026-96220 | HIGH 7.8 | microsoft windows_10_1809 Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-95664 | MED 5.4 | apache camel Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. | 0.3% | — |
| CVE-2026-70122 | MED 6.5 | microsoft windows_10_21h2 Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-59319 | MED 4.3 | vmware spring_ai RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An app | 0.3% | — |
| CVE-2026-57028 | HIGH 7.3 | juniper junos_os_evolved An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to an incorrect initialization, a process which shoul | 0.3% | — |
| CVE-2026-45658 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-44810 | HIGH 8.4 | microsoft windows_11_23h2 Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-40971 | MED 5.0 | vmware spring_boot When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory. | 0.3% | — |
| CVE-2026-12441 | HIGH 8.8 | google chrome Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-113295 | MED 6.5 | google chrome Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-113157 | MED 6.5 | google chrome Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2026-11047 | CRIT 9.6 | google chrome Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2026-11042 | HIGH 8.8 | google chrome Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2025-62631 | MED 5.6 | fortinet fortios An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN sessio | 0.3% | — |
| CVE-2025-52964 | MED 6.5 | juniper junos A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When the device receives a specific BGP UPDATE pac | 0.3% | — |