60.361 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.361 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2010-4573 | HIGH 9.3 | vmware esxi The Update Installer in VMware ESXi 4.1, when a modified sfcb.cfg is present, does not properly configure the SFCB authentication mode, which allows remote attackers to obtain access via an arbitrary username and password. | 2.5% | — |
| CVE-2010-2984 | HIGH 10.0 | cisco unified_wireless_network_solution_software Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 on 4404 series controllers does not properly implement the WEBAUTH_REQD state, which allows remote attackers to bypass intended access restrictions via WLAN traffic, aka Bug ID CSCtb75305. | 2.5% | — |
| CVE-2010-0042 | MED 4.3 | apple safari ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory, which allows remote attackers to obtain potentially sensitive information from process memory via a crafted TIFF ima | 2.5% | — |
| CVE-2010-0041 | MED 4.3 | apple safari ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory, which allows remote attackers to obtain potentially sensitive information from process memory via a crafted BMP imag | 2.5% | — |
| CVE-2023-42795 | MED 5.3 | apache tomcat Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc | 2.5% | — |
| CVE-2018-0213 | HIGH 8.8 | cisco identity_services_engine A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit t | 2.5% | — |
| CVE-2009-0618 | HIGH 8.5 | cisco application_networking_manager Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gain privileges, and cause a denial of service (service outage) by stopping processes, or obtain sensitive information by r | 2.5% | — |
| CVE-2022-30303 | HIGH 8.8 | fortinet fortiweb An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user vi | 2.5% | — |
| CVE-2021-28545 | HIGH 8.1 | adobe acrobat Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker would have the ability to completely manipulate data in a ce | 2.5% | — |
| CVE-2018-0121 | CRIT 9.8 | cisco elastic_services_controller A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileg | 2.5% | — |
| CVE-2017-6629 | MED 5.3 | cisco unity_connection A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem of an affected device. The issue is due to improper sanitization of user-supplie | 2.5% | — |
| CVE-2016-6445 | CRIT 9.1 | cisco meeting_server A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate | 2.5% | — |
| CVE-2001-0757 | HIGH 7.5 | cisco 6400_nrp_2 Cisco 6400 Access Concentrator Node Route Processor 2 (NRP2) 12.1DC card does not properly disable access when a password has not been set for vtys, which allows remote attackers to obtain access via telnet. | 2.5% | — |
| CVE-2026-55009 | HIGH 7.8 | microsoft exchange_server Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | 2.5% | — |
| CVE-2024-21409 | HIGH 7.3 | microsoft .net .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2017-15695 | HIGH 8.8 | apache geode When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restrict | 2.5% | — |
| CVE-2021-36008 | LOW 3.3 | adobe illustrator Adobe Illustrator version 25.2.3 (and earlier) is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the c | 2.5% | — |
| CVE-2019-6982 | MED 5.5 | foxitsoftware 3d An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Write and crash during the handling of certain PDF files that embed specifically crafted 3D content, because of | 2.5% | — |
| CVE-2014-6379 | HIGH 7.5 | juniper junos Juniper Junos 11.4 before R12, 12.1 before R10, 12.1X44 before D35, 12.1X45 before D25, 12.1X46 before D20, 12.1X47 before D10, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S3, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R4, 13.2X | 2.5% | — |
| CVE-2002-0792 | MED 5.0 | cisco content_services_switch_11000 The web management interface for Cisco Content Service Switch (CSS) 11000 switches allows remote attackers to cause a denial of service (soft reset) via (1) an HTTPS POST request, or (2) malformed XML data. | 2.5% | — |
| CVE-2022-26901 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2018-14617 | MED 5.5 | canonical ubuntu_linux An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and | 2.5% | — |
| CVE-2023-36910 | CRIT 9.8 | microsoft windows_10 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2021-24081 | HIGH 7.8 | microsoft windows_10 Microsoft Windows Codecs Library Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2019-8240 | HIGH 7.5 | adobe bridge_cc Adobe Bridge CC versions 9.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to information disclosure. | 2.5% | — |