60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-4966 | MED 6.5 | fortinet fortiwan The diagnosis_control.php page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter. | 2.2% | — |
| CVE-2015-3613 | CRIT 9.8 | fortinet fortimanager A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page | 2.2% | — |
| CVE-2012-5222 | MED 5.0 | hp service_manager_web_tier HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to obtain sensitive information via unspecified vectors. | 2.2% | — |
| CVE-2025-62472 | HIGH 7.8 | microsoft windows_10_1607 Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | 2.2% | — |
| CVE-2022-39135 | CRIT 9.8 | apache calcite Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefor | 2.2% | — |
| CVE-2020-20907 | CRIT 9.1 | metinfo metinfo MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php. | 2.2% | — |
| CVE-2000-0150 | HIGH 7.5 | checkpoint firewall-1 Check Point Firewall-1 allows remote attackers to bypass port access restrictions on an FTP server by forcing it to send malicious packets that Firewall-1 misinterprets as a valid 227 response to a client's PASV attempt. | 2.2% | — |
| CVE-2022-23273 | HIGH 7.1 | microsoft dynamics_gp Microsoft Dynamics GP Elevation Of Privilege Vulnerability | 2.2% | — |
| CVE-2020-3531 | CRIT 9.8 | cisco iot_field_network_director A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authentica | 2.2% | — |
| CVE-2019-0839 | MED 4.4 | microsoft windows_10 An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0838. | 2.2% | — |
| CVE-2017-11587 | HIGH 7.5 | cisco residential_gateway_firmware On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is directory traversal in the filename parameter to the /download.conf URI. | 2.2% | — |
| CVE-2014-3343 | MED 4.3 | cisco ios_xr Cisco IOS XR 5.1 allows remote attackers to cause a denial of service (DHCPv6 daemon crash) via a malformed DHCPv6 packet, aka Bug ID CSCuo59052. | 2.2% | — |
| CVE-2011-2547 | HIGH 9.0 | cisco sa500_software The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681. | 2.2% | — |
| CVE-2019-1337 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update Client Information Disclosure Vulnerability'. | 2.2% | — |
| CVE-2025-52520 | HIGH 7.5 | apache tomcat For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9. | 2.2% | — |
| CVE-2022-35840 | HIGH 8.8 | microsoft windows_10 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2022-35836 | HIGH 8.8 | microsoft windows_10 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2022-35835 | HIGH 8.8 | microsoft windows_10 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2022-35834 | HIGH 8.8 | microsoft windows_10 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2022-34733 | HIGH 8.8 | microsoft windows_10 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2022-34731 | HIGH 8.8 | microsoft windows_10 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 2.2% | — |
| CVE-2017-11852 | MED 4.7 | microsoft windows_7 Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run a specially crafted application to compromise the user's system, due improperly disclosing kernel memory addresses, aka " | 2.2% | — |
| CVE-2013-6973 | MED 4.3 | cisco webex_training_center Cisco WebEx Training Center allows remote attackers to discover registration IDs via a crafted URL, aka Bug ID CSCul57121. | 2.2% | — |
| CVE-2007-1212 | MED 6.6 | microsoft windows_2000 Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via a crafted Enhanced Metafile (EMF) image format file. | 2.2% | — |
| CVE-2024-21400 | CRIT 9.0 | microsoft confcom Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability | 2.2% | — |