60.304 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.304 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-0066 | HIGH 8.4 | intel amt_ac_8260_firmware Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access. | 0.3% | — |
| CVE-2020-5912 | HIGH 7.1 | f5 big-ip_access_policy_manager In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files. | 0.3% | — |
| CVE-2020-3208 | MED 6.7 | cisco ios A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could allow an authenticated, local attacker to boot a malicious software image on an affected device. The vu | 0.3% | — |
| CVE-2019-1911 | MED 5.3 | cisco hosted_collaboration_solution A vulnerability in the CLI of Cisco Unified Communications Domain Manager (Cisco Unified CDM) Software could allow an authenticated, local attacker to escape the restricted shell. The vulnerability is due to insufficient input validation of shell commands. An | 0.3% | — |
| CVE-2018-12210 | MED 6.5 | intel graphics_driver Multiple pointer dereferences in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 pote | 0.3% | — |
| CVE-2017-7768 | MED 5.5 | mozilla firefox The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Servic | 0.3% | — |
| CVE-2016-8443 | HIGH 7.8 | linux linux_kernel Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. Versions: Kernel 3.18. Android ID: A-32576499. References: QC-CR#964185. | 0.3% | — |
| CVE-2013-3497 | MED 4.7 | juniper junos_space Juniper Junos Space before 12.3P2.8, as used on the JA1500 appliance and in other contexts, includes a cleartext password in a configuration tab, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen. | 0.3% | — |
| CVE-2012-4077 | MED 6.8 | cisco nx-os Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via the sed e option, aka Bug IDs CSCtf25457 and CSCtf27651. | 0.3% | — |
| CVE-2010-4248 | MED 4.9 | linux linux_kernel Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and th | 0.3% | — |
| CVE-2006-5871 | MED 4.1 | linux linux_kernel smbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings. | 0.3% | — |
| CVE-1999-0780 | MED 4.6 | freebsd freebsd KDE klock allows local users to kill arbitrary processes by specifying an arbitrary PID in the .kss.pid file. | 0.3% | — |
| CVE-2026-88070 | HIGH 7.8 | microsoft windows_10_1607 Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-85338 | HIGH 7.8 | microsoft windows_10_1809 Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-69534 | HIGH 7.8 | microsoft windows_10_1607 Improper neutralization of special elements used in a command ('command injection') in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-68792 | HIGH 7.8 | microsoft 365_apps Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-65673 | HIGH 7.8 | microsoft entra_connect Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges over a network. | 0.3% | — |
| CVE-2026-58635 | HIGH 7.8 | microsoft windows_10_1809 Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-50523 | HIGH 7.8 | microsoft powershell Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-50488 | HIGH 7.8 | microsoft windows_11_24h2 Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-64156 | HIGH 7.2 | fortinet fortivoice An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticate | 0.3% | — |
| CVE-2025-58457 | MED 4.3 | apache zookeeper Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, whi | 0.3% | — |
| CVE-2025-5480 | HIGH 7.8 | action1 agent Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1. An attacker must first obtain the ability to execute low-privileged code | 0.3% | — |
| CVE-2025-27177 | HIGH 7.8 | adobe indesign InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v | 0.3% | — |
| CVE-2025-27171 | HIGH 7.8 | adobe indesign InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v | 0.3% | — |