60.361 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.361 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2013-4387 | MED 6.1 | linux linux_kernel net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service ( | 2.6% | — |
| CVE-2025-60705 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. | 2.6% | — |
| CVE-2018-3995 | HIGH 8.8 | foxitsoftware phantompdf An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution | 2.6% | — |
| CVE-2018-3944 | HIGH 8.8 | foxitsoftware phantompdf An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution | 2.6% | — |
| CVE-2018-3943 | HIGH 8.8 | foxitsoftware phantompdf An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution | 2.6% | — |
| CVE-2011-0259 | HIGH 7.6 | apple itunes CoreFoundation, as used in Apple iTunes before 10.5, does not properly perform string tokenization, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vector | 2.6% | — |
| CVE-2021-40463 | HIGH 7.7 | microsoft windows_10 Windows Network Address Translation (NAT) Denial of Service Vulnerability | 2.6% | — |
| CVE-2007-4263 | HIGH 8.5 | cisco ios Unspecified vulnerability in the server side of the Secure Copy (SCP) implementation in Cisco 12.2-based IOS allows remote authenticated users to read, write or overwrite any file on the device's filesystem via unknown vectors. | 2.6% | — |
| CVE-2014-6478 | MED 4.3 | juniper junos_space Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect integrity via vectors related to SERVER:SSL:yaSSL. | 2.6% | — |
| CVE-2010-4689 | HIGH 7.8 | cisco 5500_series_adaptive_security_appliance Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) do not properly preserve ACL behavior after a migration, which allows remote attackers to bypass intended access restrictions via an unspecified type of network traffic th | 2.6% | — |
| CVE-2023-21605 | HIGH 7.8 | adobe acrobat Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exp | 2.6% | — |
| CVE-2020-36279 | HIGH 7.5 | debian debian_linux Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c. | 2.6% | — |
| CVE-2024-22259 | HIGH 8.1 | netapp active_iq_unified_manager Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/def | 2.6% | — |
| CVE-2022-45143 | HIGH 7.5 | apache tomcat The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to su | 2.6% | — |
| CVE-2018-11787 | HIGH 8.1 | apache karaf In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the co | 2.6% | — |
| CVE-2015-1719 | LOW 2.1 | microsoft windows_7 The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to obtain sens | 2.6% | — |
| CVE-2011-0389 | HIGH 7.8 | cisco telepresence_multipoint_switch Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x allow remote attackers to cause a denial of service (process crash) via a crafted Real-Time Transport Control Protocol (RTCP) UDP packet, aka Bug ID CSCth60993. | 2.6% | — |
| CVE-2010-1890 | MED 4.6 | microsoft windows_7 The kernel in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate ACLs on kernel objects, which allows local users to cause a denial of service (reboot) via a crafted application, aka "Windows Ke | 2.6% | — |
| CVE-2025-29810 | HIGH 7.5 | microsoft windows_10_1507 Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network. | 2.6% | — |
| CVE-2023-36786 | HIGH 7.2 | microsoft skype_for_business_server Skype for Business Remote Code Execution Vulnerability | 2.6% | — |
| CVE-2022-22004 | HIGH 7.8 | microsoft 365_apps Microsoft Office ClickToRun Remote Code Execution Vulnerability | 2.6% | — |
| CVE-2019-10638 | MED 6.5 | linux linux_kernel In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain has | 2.6% | — |
| CVE-2007-5352 | HIGH 7.2 | microsoft windows_2000 Unspecified vulnerability in Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows local users to gain privileges via a crafted local procedure call (LPC) request. | 2.6% | — |
| CVE-2018-5535 | HIGH 7.5 | f5 big-ip_access_policy_manager On F5 BIG-IP 14.0.0, 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.5.1-11.6.3 specifically crafted HTTP responses, when processed by a Virtual Server with an associated QoE profile that has Video enabled, may cause TMM to incorrectly buffer response data causing the TMM | 2.6% | — |
| CVE-2018-0288 | MED 5.3 | cisco webex_meetings_online A vulnerability in Cisco WebEx Recording Format (WRF) Player could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance a | 2.6% | — |