60.304 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.304 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-21910 | HIGH 7.8 | advantech r-seenet A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker | 0.3% | — |
| CVE-2021-1436 | MED 4.4 | cisco ios_xe A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. This vulnerability is due to insufficient validation of u | 0.3% | — |
| CVE-2021-1233 | MED 4.4 | cisco catalyst_sd-wan_manager A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vulnerability is due to insufficient input validation of requests that are sent to the iperf tool. An at | 0.3% | — |
| CVE-2020-3990 | MED 6.5 | vmware horizon_client VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an integer overflow issue in Cortado ThinPrint component. A malicious actor with normal access to a virtual machine may be able t | 0.3% | — |
| CVE-2020-3477 | MED 5.5 | cisco ios A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution | 0.3% | — |
| CVE-2020-3396 | MED 6.8 | cisco ios_xe A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace conta | 0.3% | — |
| CVE-2020-3394 | HIGH 7.8 | cisco nx-os A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administrative privileges. To e | 0.3% | — |
| CVE-2020-1682 | MED 5.5 | juniper junos An input validation vulnerability exists in Juniper Networks Junos OS, allowing an attacker to crash the srxpfe process, causing a Denial of Service (DoS) through the use of specific maintenance commands. The srxpfe process restarts automatically, but continuo | 0.3% | — |
| CVE-2008-4914 | MED 4.7 | vmware esx Unspecified vulnerability in VMware ESXi 3.5 before ESXe350-200901401-I-SG and ESX 3.5 before ESX350-200901401-SG allows local administrators to cause a denial of service (host crash) via a snapshot with a malformed VMDK delta disk. | 0.3% | — |
| CVE-2026-97799 | HIGH 7.8 | microsoft windows_11_24h2 Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-83756 | HIGH 7.8 | microsoft windows_10_21h2 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-62874 | CRIT 10.0 | microsoft azure_billing Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. | 0.3% | — |
| CVE-2026-43172 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix 22000 series SMEM parsing If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Reje | 0.3% | — |
| CVE-2026-11021 | CRIT 9.6 | google chrome Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity | 0.3% | — |
| CVE-2026-11009 | CRIT 9.6 | google chrome Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | 0.3% | — |
| CVE-2026-10972 | CRIT 9.6 | google chrome Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-10897 | HIGH 8.8 | google chrome Inappropriate implementation in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-10891 | HIGH 8.8 | google chrome Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-100227 | HIGH 7.5 | apache cxf Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to | 0.3% | — |
| CVE-2025-8901 | HIGH 8.8 | google chrome Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2025-59215 | HIGH 7.0 | microsoft windows_11_24h2 Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2025-55228 | HIGH 7.8 | microsoft windows_10_21h2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2025-37861 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread | 0.3% | — |
| CVE-2025-27161 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage | 0.3% | — |
| CVE-2025-0913 | MED 5.5 | golang go os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink t | 0.3% | — |