60.267 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.267 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-53517 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.g. 4 in Shuang's testing, | 0.3% | — |
| CVE-2023-51782 | HIGH 7.0 | debian debian_linux An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition. | 0.3% | — |
| CVE-2023-28981 | MED 6.5 | juniper junos An Improper Input Validation vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). If the receipt of router advertisements is enabled on an interface and a | 0.3% | — |
| CVE-2023-28974 | HIGH 7.4 | juniper junos An Improper Check for Unusual or Exceptional Conditions vulnerability in the bbe-smgd of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). In a Broadband Edge / Subscriber Management scenario on MX Serie | 0.3% | — |
| CVE-2023-28970 | MED 6.5 | juniper junos An Improper Check or Handling of Exceptional Conditions vulnerability in packet processing on the network interfaces of Juniper Networks Junos OS on JRR200 route reflector appliances allows an adjacent, network-based attacker sending a specific packet to the d | 0.3% | — |
| CVE-2023-28959 | MED 6.5 | juniper junos An Improper Check or Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on QFX10002 allows an unauthenticated, adjacent attacker on the local broadcast domain sending a malformed packet to the device, causing all | 0.3% | — |
| CVE-2022-49264 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name | 0.3% | — |
| CVE-2022-49217 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xx_send_abort_all(), the n_elem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task c | 0.3% | — |
| CVE-2022-41983 | LOW 3.7 | f5 big-ip_access_policy_manager On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause | 0.3% | — |
| CVE-2022-27513 | HIGH 8.3 | citrix application_delivery_controller_firmware Remote desktop takeover via phishing | 0.3% | — |
| CVE-2021-29649 | MED 5.5 | fedoraproject fedora An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677. | 0.3% | — |
| CVE-2021-28375 | HIGH 7.8 | fedoraproject fedora An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308. | 0.3% | — |
| CVE-2020-5892 | MED 6.7 | f5 big-ip_access_policy_manager In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory. | 0.3% | — |
| CVE-2017-7761 | MED 5.5 | mozilla firefox The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be | 0.3% | — |
| CVE-2016-1360 | HIGH 7.1 | cisco prime_lan_management_solution Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw85390. | 0.3% | — |
| CVE-2012-4081 | MED 4.6 | cisco unified_computing_system MCServer in the Cisco Management Controller in Cisco Unified Computing System (UCS) allows local users to cause a denial of service (application crash) via invalid MCTools parameters, aka Bug ID CSCtg20734. | 0.3% | — |
| CVE-2026-96108 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85320 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | 0.3% | — |
| CVE-2026-7345 | HIGH 8.3 | google chrome Insufficient validation of untrusted input in Feedback in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Hig | 0.3% | — |
| CVE-2026-70273 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-70236 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-48441 | HIGH 8.6 | adobe lightroom Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directori | 0.3% | — |
| CVE-2026-47850 | MED 4.3 | vmware spring_data_rest Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST | 0.3% | — |
| CVE-2026-41728 | HIGH 7.5 | vmware spring_data_rest Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 throug | 0.3% | — |
| CVE-2026-1561 | MED 5.4 | ibm websphere_application_server IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading | 0.3% | — |