60.368 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.368 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-36602 | HIGH 7.5 | microsoft windows_10_1507 Windows TCP/IP Denial of Service Vulnerability | 2.5% | — |
| CVE-2022-31780 | HIGH 7.5 | apache traffic_server Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. | 2.5% | — |
| CVE-2022-28129 | HIGH 7.5 | apache traffic_server Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. | 2.5% | — |
| CVE-2021-31200 | HIGH 7.2 | microsoft neural_network_intelligence Common Utilities Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2020-1173 | MED 6.8 | microsoft power_bi_report_server A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. | 2.5% | — |
| CVE-2010-2220 | MED 5.0 | adobe flash_media_server Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to cause a denial of service via unspecified vectors, related to an "input validation issue." | 2.5% | — |
| CVE-2010-2219 | MED 5.0 | adobe flash_media_server Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to cause a denial of service (memory consumption) via unknown vectors. | 2.5% | — |
| CVE-2010-2218 | MED 5.0 | adobe flash_media_server Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to cause a denial of service via unspecified vectors, related to a "JS method issue." | 2.5% | — |
| CVE-2007-5134 | MED 5.0 | cisco catalyst_6500 Cisco Catalyst 6500 and Cisco 7600 series devices use 127/8 IP addresses for Ethernet Out-of-Band Channel (EOBC) internal communication, which might allow remote attackers to send packets to an interface for which network exposure was unintended. | 2.5% | — |
| CVE-2026-62392 | CRIT 9.8 | apache kylin Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recom | 2.5% | — |
| CVE-2026-45591 | HIGH 7.5 | microsoft .net Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2.5% | — |
| CVE-2022-25757 | CRIT 9.8 | apache apisix In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the body_schema validation in the request-validation plugin. Fo | 2.5% | — |
| CVE-2015-8104 | CRIT 10.0 | canonical ubuntu_linux The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c. | 2.5% | — |
| CVE-2012-0287 | LOW 2.6 | wordpress wordpress Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handl | 2.5% | — |
| CVE-2024-38073 | HIGH 7.5 | microsoft windows_server_2008 Windows Remote Desktop Licensing Service Denial of Service Vulnerability | 2.5% | — |
| CVE-2024-21755 | HIGH 8.8 | fortinet fortisandbox A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized | 2.5% | — |
| CVE-2021-24070 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2021-24068 | HIGH 7.8 | microsoft excel Microsoft Excel Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2021-24067 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2020-3586 | CRIT 9.4 | cisco dna_spaces\ A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient validation of user-supplied input | 2.5% | — |
| CVE-2007-3945 | MED 6.4 | rsbac rule_set_based_access_control Rule Set Based Access Control (RSBAC) before 1.3.5 does not properly use the Linux Kernel Crypto API for the Linux kernel 2.6.x, which allows context-dependent attackers to bypass authentication controls via unspecified vectors, possibly involving User Managem | 2.5% | — |
| CVE-2018-14613 | MED 5.5 | linux linux_kernel An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item validation in check_leaf_item in fs/btrfs/tree-ch | 2.5% | — |
| CVE-2018-14610 | MED 5.5 | linux linux_kernel An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification that each block group has a corresponding chunk at mount ti | 2.5% | — |
| CVE-2017-3876 | HIGH 7.5 | cisco ios_xr A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of gRPC req | 2.5% | — |
| CVE-2017-3859 | HIGH 7.5 | cisco ios_xe A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vul | 2.5% | — |