60.297 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.297 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-49725 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows Notification allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-37874 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix memory leak in ngbe_probe() error path When ngbe_sw_init() is called, memory is allocated for wx->rss_key in wx_init_rss_key(). However, in ngbe_probe() function, the subseque | 0.3% | — |
| CVE-2024-57899 | HIGH 7.6 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mbss changed flags corruption on 32 bit systems On 32-bit systems, the size of an unsigned long is 4 bytes, while a u64 is 8 bytes. Therefore, when using or_each_set_bit( | 0.3% | — |
| CVE-2024-56476 | MED 5.3 | ibm txseries_for_multiplatforms IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy. | 0.3% | — |
| CVE-2024-49882 | HIGH 7.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of | 0.3% | — |
| CVE-2024-49783 | MED 5.3 | ibm openpages_with_watson IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data | 0.3% | — |
| CVE-2024-47721 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn't implemented, | 0.3% | — |
| CVE-2024-20279 | MED 4.3 | cisco application_policy_infrastructure_controller A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) poli | 0.3% | — |
| CVE-2024-20258 | MED 6.1 | cisco asyncos A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vu | 0.3% | — |
| CVE-2023-51559 | LOW 3.3 | foxit pdf_editor Foxit PDF Reader Doc Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that | 0.3% | — |
| CVE-2023-51042 | HIGH 7.8 | linux linux_kernel In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free. | 0.3% | — |
| CVE-2023-47081 | MED 5.5 | adobe substance_3d_stager Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this i | 0.3% | — |
| CVE-2023-47080 | MED 5.5 | adobe substance_3d_stager Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this i | 0.3% | — |
| CVE-2023-28345 | MED 4.6 | faronics insight An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console | 0.3% | — |
| CVE-2023-1697 | MED 6.5 | juniper junos An Improper Handling of Missing Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a dcpfe process core and thereby a Denial of Service (DoS). Continued receipt of these | 0.3% | — |
| CVE-2022-43852 | MED 5.3 | ibm aspera_console IBM Aspera Console 3.4.0 through 3.4.4 could disclose sensitive information in HTTP headers that could be used in further attacks against the system. | 0.3% | — |
| CVE-2022-36879 | MED 5.5 | debian debian_linux An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. | 0.3% | — |
| CVE-2022-3567 | MED 4.6 | linux linux_kernel A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch t | 0.3% | — |
| CVE-2021-1441 | MED 6.7 | cisco ios_xe A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300 Embedded Series Routers could allow an authenticated, local attacker to execute unsigned code at sys | 0.3% | — |
| CVE-2020-4382 | MED 5.5 | ibm elastic_storage_server IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment or upgrade pertaining to xcat services. IBM X-Force ID: 179163. | 0.3% | — |
| CVE-2019-4719 | MED 5.5 | ibm mq IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. | 0.3% | — |
| CVE-2019-4619 | MED 5.5 | ibm mq IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862. | 0.3% | — |
| CVE-2018-15332 | HIGH 7.0 | f5 big-ip_access_policy_manager The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host in a race condition. | 0.3% | — |
| CVE-2017-17712 | HIGH 7.0 | linux linux_kernel The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges. | 0.3% | — |
| CVE-2017-10606 | MED 4.4 | juniper trusted_platform_module_firmware Version 4.40 of the TPM (Trusted Platform Module) firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys that may allow an attacker to decrypt sensitive information in SRX300 Series products. The TPM is used in the SRX300 Se | 0.3% | — |