60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-28714 | MED 6.5 | debian debian_linux Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's | 0.3% | — |
| CVE-2021-26087 | MED 4.3 | fortinet fortiwlc An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated remote attackers and non-authenticated attackers in the same ne | 0.3% | — |
| CVE-2020-4411 | HIGH 7.1 | ibm spectrum_scale The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel module that could allow an attacker to cause a denial of service condition on the affected system. To e | 0.3% | — |
| CVE-2020-36311 | MED 5.5 | debian debian_linux An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184. | 0.3% | — |
| CVE-2019-17437 | HIGH 7.8 | paloaltonetworks pan-os An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0 | 0.3% | — |
| CVE-2016-9794 | HIGH 7.8 | linux linux_kernel Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PC | 0.3% | — |
| CVE-2016-5109 | MED 4.3 | citrix worx_home Citrix Worx Home for iOS before 10.3.6 and XenMobile MDX Toolkit for iOS before 10.3.6 might allow physically proximate attackers to bypass in-application Apple Touch ID authentication via unspecified vectors, related to an application requiring re-authenticat | 0.3% | — |
| CVE-2014-4652 | LOW 1.9 | canonical ubuntu_linux Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveragi | 0.3% | — |
| CVE-2013-3408 | MED 6.8 | cisco virtualization_experience_client_6000 The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users to gain privileges via an unspecified sequence of commands, aka Bug ID CSCuc31764. | 0.3% | — |
| CVE-2008-7256 | LOW 1.2 | linux linux_kernel mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference | 0.3% | — |
| CVE-2005-2617 | LOW 3.6 | linux linux_kernel The syscall32_setup_pages function in syscall32.c for Linux kernel 2.6.12 and later, on the 64-bit x86 platform, does not check the return value of the insert_vm_struct function, which allows local users to trigger a memory leak via a 32-bit application with c | 0.3% | — |
| CVE-2000-0090 | LOW 3.6 | vmware workstation VMWare 1.1.2 allows local users to cause a denial of service via a symlink attack. | 0.3% | — |
| CVE-2026-88147 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-6306 | HIGH 8.8 | google chrome Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-6305 | HIGH 8.8 | google chrome Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-4440 | HIGH 8.8 | google chrome Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-32193 | HIGH 8.8 | microsoft azure_kubernetes_service Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally. | 0.3% | — |
| CVE-2026-0259 | HIGH 8.8 | paloaltonetworks pan-os An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the defa | 0.3% | — |
| CVE-2026-0241 | HIGH 7.2 | paloaltonetworks trust_protection_foundation Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources. | 0.3% | — |
| CVE-2025-8011 | HIGH 8.8 | google chrome Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 0.3% | — |
| CVE-2025-64471 | MED 4.9 | fortinet fortiweb A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0 | 0.3% | — |
| CVE-2024-4944 | HIGH 7.8 | watchguard mobile_vpn_with_ssl A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileged. | 0.3% | — |
| CVE-2024-20327 | HIGH 7.4 | cisco ios_xr A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service | 0.3% | — |
| CVE-2023-20003 | MED 4.7 | cisco business_140ac_access_point_firmware A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with | 0.3% | — |
| CVE-2022-34683 | MED 5.5 | nvidia cloud_gaming NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a null-pointer dereference occurs, which may lead to denial of service. | 0.3% | — |