60.297 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.297 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-33190 | MED 5.3 | apache apisix_dashboard In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made i | 2.7% | — |
| CVE-2011-1186 | MED 5.0 | google chrome Google Chrome before 10.0.648.127 on Linux does not properly handle parallel execution of calls to the print method, which might allow remote attackers to cause a denial of service (application crash) via crafted JavaScript code. | 2.7% | — |
| CVE-2026-3910 | HIGH 8.8 | google chrome Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 2.7% | |
| CVE-2015-8795 | MED 6.1 | apache solr Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/ | 2.7% | — |
| CVE-2015-0058 | HIGH 7.2 | microsoft windows_8.1 Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application, aka "Windows Cursor Object Double Free Vulnerability." | 2.7% | — |
| CVE-2022-35678 | MED 5.5 | adobe acrobat Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerabi | 2.7% | — |
| CVE-2011-1237 | HIGH 7.2 | microsoft windows_2003_server Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain | 2.7% | — |
| CVE-2022-0028 | HIGH 8.6 | paloaltonetworks pan-os A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (vir | 2.7% | |
| CVE-2020-3554 | HIGH 7.5 | cisco adaptive_security_appliance A vulnerability in the TCP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected devic | 2.7% | — |
| CVE-2016-9208 | MED 6.5 | cisco emergency_responder A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenticated, remote attacker to access files in arbitrary locations on the file system of an affected devic | 2.7% | — |
| CVE-2015-4207 | MED 5.0 | cisco webex_meeting_center Cisco WebEx Meeting Center places a meeting's access number in a URL, which allows remote attackers to obtain sensitive information and bypass intended attendance restrictions by visiting a meeting-registration page, aka Bug ID CSCus62147. | 2.7% | — |
| CVE-2011-2578 | HIGH 7.8 | cisco ios Memory leak in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption) via malformed SIP packets on a NAT interface, aka Bug ID CSCts12366. | 2.7% | — |
| CVE-2015-6319 | CRIT 9.8 | cisco rv_series_router_firmware SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574. | 2.7% | — |
| CVE-2022-26931 | HIGH 7.5 | microsoft windows_10 Windows Kerberos Elevation of Privilege Vulnerability | 2.7% | — |
| CVE-2022-25329 | CRIT 9.8 | trendmicro serverprotect Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An unauthenticated remote attacker with access to the Information Server could exploit this to register to | 2.7% | — |
| CVE-2022-21913 | MED 5.3 | microsoft windows_10 Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass | 2.7% | — |
| CVE-2021-38629 | MED 6.5 | microsoft windows_10 Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability | 2.7% | — |
| CVE-2019-11888 | CRIT 9.8 | golang go Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain privileges. | 2.7% | — |
| CVE-2007-1209 | HIGH 7.2 | microsoft windows_vista Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection resources when starting and stopping processes, which allows local users to gain privileges by opening and closing multi | 2.7% | — |
| CVE-2007-1206 | HIGH 7.2 | microsoft windows_2000 The Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0; 2000 SP4; XP SP2; Server 2003, 2003 SP1, and 2003 SP2; and Windows Vista before June 2006; uses insecure permissions (PAGE_READWRITE) for a physical memory view, which allows loca | 2.7% | — |
| CVE-2022-40955 | HIGH 8.8 | apache inlong In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leadin | 2.7% | — |
| CVE-2001-1105 | HIGH 7.5 | cisco icdn RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure. | 2.7% | — |
| CVE-2022-26940 | MED 6.5 | microsoft remote_desktop_client Remote Desktop Protocol Client Information Disclosure Vulnerability | 2.7% | — |
| CVE-2022-22015 | MED 6.5 | microsoft remote_desktop_client Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability | 2.7% | — |
| CVE-2019-18190 | CRIT 9.8 | trendmicro antivirus\+_security_2020 Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of application, which could potentially lead to possible unsigned code execution under certain circumstances. | 2.7% | — |