60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.267 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-28970 | MED 6.5 | juniper junos An Improper Check or Handling of Exceptional Conditions vulnerability in packet processing on the network interfaces of Juniper Networks Junos OS on JRR200 route reflector appliances allows an adjacent, network-based attacker sending a specific packet to the d | 0.3% | — |
| CVE-2023-28959 | MED 6.5 | juniper junos An Improper Check or Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on QFX10002 allows an unauthenticated, adjacent attacker on the local broadcast domain sending a malformed packet to the device, causing all | 0.3% | — |
| CVE-2022-49264 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name | 0.3% | — |
| CVE-2022-49217 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xx_send_abort_all(), the n_elem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task c | 0.3% | — |
| CVE-2022-41983 | LOW 3.7 | f5 big-ip_access_policy_manager On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause | 0.3% | — |
| CVE-2022-27513 | HIGH 8.3 | citrix application_delivery_controller_firmware Remote desktop takeover via phishing | 0.3% | — |
| CVE-2021-29649 | MED 5.5 | fedoraproject fedora An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677. | 0.3% | — |
| CVE-2021-28375 | HIGH 7.8 | fedoraproject fedora An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308. | 0.3% | — |
| CVE-2020-5892 | MED 6.7 | f5 big-ip_access_policy_manager In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory. | 0.3% | — |
| CVE-2017-7761 | MED 5.5 | mozilla firefox The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be | 0.3% | — |
| CVE-2016-1360 | HIGH 7.1 | cisco prime_lan_management_solution Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw85390. | 0.3% | — |
| CVE-2012-4081 | MED 4.6 | cisco unified_computing_system MCServer in the Cisco Management Controller in Cisco Unified Computing System (UCS) allows local users to cause a denial of service (application crash) via invalid MCTools parameters, aka Bug ID CSCtg20734. | 0.3% | — |
| CVE-2026-96108 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85320 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-7973 | HIGH 8.8 | google chrome Integer overflow in Dawn in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2026-7908 | CRIT 9.6 | google chrome Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-7896 | HIGH 8.8 | google chrome Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-70273 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-70236 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-5292 | HIGH 8.8 | google chrome Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2026-5290 | CRIT 9.6 | google chrome Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-5289 | CRIT 9.6 | google chrome Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-5288 | CRIT 9.6 | google chrome Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-5274 | HIGH 8.8 | google chrome Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-48441 | HIGH 8.6 | adobe lightroom Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directori | 0.3% | — |