60.361 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.361 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2018-0384 | MED 5.8 | cisco secure_firewall_management_center A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because | 2.5% | — |
| CVE-2014-5209 | MED 5.3 | f5 big-ip_access_policy_manager An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information. | 2.5% | — |
| CVE-2022-30208 | MED 6.5 | microsoft windows_10 Windows Security Account Manager (SAM) Denial of Service Vulnerability | 2.5% | — |
| CVE-2018-0271 | CRIT 9.8 | cisco digital_network_architecture_center A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and access critical services. The vulnerability is due to a failure to normalize URLs prior to se | 2.5% | — |
| CVE-2017-11783 | HIGH 7.0 | microsoft windows_10 Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability in the way it handles calls to Advanced Local Procedure Call (ALPC), aka "Windows Eleva | 2.5% | — |
| CVE-2008-1998 | HIGH 8.5 | ibm db2 The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter. | 2.5% | — |
| CVE-2024-38132 | HIGH 7.5 | microsoft windows_10_1507 Windows Network Address Translation (NAT) Denial of Service Vulnerability | 2.5% | — |
| CVE-2022-24543 | HIGH 7.8 | microsoft windows_upgrade_assistant Windows Upgrade Assistant Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2021-34450 | HIGH 8.5 | microsoft windows_10 Windows Hyper-V Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2022-34716 | MED 5.9 | microsoft .net .NET Spoofing Vulnerability | 2.5% | — |
| CVE-2022-22037 | HIGH 7.5 | microsoft windows_10 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | 2.5% | — |
| CVE-2015-0757 | MED 5.0 | cisco identity_services_engine_software The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSC | 2.5% | — |
| CVE-2021-40119 | CRIT 9.8 | cisco policy_suite A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user. This vulnerability is due to the re-use of static SSH keys across installation | 2.5% | — |
| CVE-2018-3962 | HIGH 7.3 | foxitsoftware phantompdf A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the CreationDate property of the this.info object. An attacker needs to trick the user t | 2.5% | — |
| CVE-2022-21992 | HIGH 7.8 | microsoft windows_10 Windows Mobile Device Management Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2022-21857 | HIGH 8.8 | microsoft windows_10 Active Directory Domain Services Elevation of Privilege Vulnerability | 2.5% | — |
| CVE-2022-21221 | MED 5.9 | fasthttp_project fasthttp The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue i | 2.5% | — |
| CVE-2017-15712 | MED 6.5 | apache oozie Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive | 2.5% | — |
| CVE-2012-0367 | HIGH 7.8 | cisco unity_connection Cisco Unity Connection before 7.1.5b(Su5), 8.0 and 8.5 before 8.5.1(Su3), and 8.6 before 8.6.2 allows remote attackers to cause a denial of service (services crash) via a series of crafted TCP segments, aka Bug ID CSCtq67899. | 2.5% | — |
| CVE-2023-32258 | HIGH 8.1 | linux linux_kernel A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an obj | 2.5% | — |
| CVE-2022-35769 | HIGH 7.5 | microsoft windows_10 Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability | 2.5% | — |
| CVE-2018-15383 | HIGH 7.5 | cisco adaptive_security_appliance_software A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, result | 2.5% | — |
| CVE-2013-6707 | MED 4.3 | cisco adaptive_security_appliance_software Memory leak in the connection-manager implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to cause a denial of service (multi-protocol management outage) by making multiple management session requests, | 2.5% | — |
| CVE-2010-1888 | MED 6.8 | microsoft windows_xp Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability." | 2.5% | — |
| CVE-2005-3804 | MED 6.4 | cisco 7920_wireless_ip_phone Cisco IP Phone (VoIP) 7920 1.0(8) listens to UDP port 17185 to support a VxWorks debugger, which allows remote attackers to obtain sensitive information and cause a denial of service. | 2.5% | — |