60.304 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.304 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-5295 | HIGH 7.8 | mozilla firefox This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MF | 0.3% | — |
| CVE-2012-4089 | MED 6.6 | cisco unified_computing_system MCTOOLS in the fabric interconnect in Cisco Unified Computing System (UCS) allows local users to execute arbitrary Baseboard Management Controller (BMC) commands by leveraging (1) local, (2) shell-level, or (3) debug-level privileges at the operating-system la | 0.3% | — |
| CVE-2010-3049 | MED 5.5 | cisco ios Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot). | 0.3% | — |
| CVE-2026-9927 | HIGH 8.8 | google chrome Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-96926 | MED 5.5 | microsoft windows_10_1607 Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-83946 | HIGH 8.2 | microsoft azure_portal Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network. | 0.3% | — |
| CVE-2026-83919 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-70087 | MED 5.5 | microsoft windows_10_1607 Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally. | 0.3% | — |
| CVE-2026-70085 | MED 5.5 | microsoft windows_server_2012 Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-70083 | MED 5.5 | microsoft windows_10_1607 Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2026-69646 | HIGH 8.3 | microsoft skype_for_business_server Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network. | 0.3% | — |
| CVE-2026-69559 | MED 5.8 | microsoft teams Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. | 0.3% | — |
| CVE-2026-5870 | HIGH 8.8 | google chrome Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-46303 | HIGH 8.2 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checkin | 0.3% | — |
| CVE-2026-43215 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_ses_lock to protect a lot of objects that are not just the server, ses or tcon lists. We later introduced srv_lock, ses_lo | 0.3% | — |
| CVE-2026-35420 | HIGH 7.8 | microsoft windows_server_2012 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-32222 | HIGH 7.8 | microsoft windows_11_24h2 Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-32070 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-31771 | HIGH 8.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but be | 0.3% | — |
| CVE-2026-21224 | HIGH 7.8 | microsoft azure_connected_machine_agent Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-13799 | HIGH 8.1 | google chrome Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-103560 | MED 5.5 | microsoft windows_server_2012 Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. | 0.3% | — |
| CVE-2025-36171 | MED 4.9 | ibm aspera_faspex IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption. | 0.3% | — |
| CVE-2025-22056 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by | 0.3% | — |
| CVE-2024-7347 | MED 4.7 | f5 nginx_open_source NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with | 0.3% | — |