57.056 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.056 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-57085 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-50469 | HIGH 7.8 | microsoft windows_10_1809 Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-50454 | HIGH 7.8 | microsoft windows_11_24h2 Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-50438 | HIGH 8.8 | microsoft pc_manager Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-46031 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Reinstate disabling of BHs around IRQ handler If the driver executes ks8851_irq() AND a TX packet has been sent, then the driver enables TX queue via netif_wake_queue() which sc | 0.4% | — |
| CVE-2026-45460 | MED 4.7 | microsoft 365_apps Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-43114 | CRIT 9.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pi | 0.4% | — |
| CVE-2026-25176 | HIGH 7.8 | microsoft windows_10_1607 Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-20166 | MED 5.4 | cisco common_services_platform_collector A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due t | 0.4% | — |
| CVE-2024-49950 | HIGH 8.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr | 0.4% | — |
| CVE-2024-49823 | MED 6.5 | ibm common_cryptographic_architecture IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an authenticated user to cause a denial of service in the Hardware Security Module (HSM) using a specially crafted sequence of valid requests. | 0.4% | — |
| CVE-2024-47493 | MED 6.5 | juniper junos A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS on the MX Series platforms with Trio-based FPCs allows an unauthenticated, adjacent attacker to cause a Denial of Service | 0.4% | — |
| CVE-2024-47416 | HIGH 7.8 | adobe animate Animate versions 23.0.7, 24.0.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim | 0.4% | — |
| CVE-2024-47411 | HIGH 7.8 | adobe animate Animate versions 23.0.7, 24.0.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim | 0.4% | — |
| CVE-2024-41010 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcx_entry Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported an issue that the tcx_entry can be released too early leading to a use aft | 0.4% | — |
| CVE-2024-25051 | MED 6.6 | ibm jazz_reporting_service IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system. | 0.4% | — |
| CVE-2024-20488 | MED 6.1 | cisco unified_communications_manager A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-s | 0.4% | — |
| CVE-2024-20261 | MED 5.8 | cisco secure_firewall_threat_defense A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. T | 0.4% | — |
| CVE-2023-4552 | MED 5.5 | opentext appbuilder Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including | 0.4% | — |
| CVE-2023-38043 | HIGH 7.8 | ivanti secure_access_client A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine a | 0.4% | — |
| CVE-2023-33301 | MED 6.5 | fortinet fortios An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host. | 0.4% | — |
| CVE-2022-25635 | MED 6.5 | realtek bluetooth_mesh_software_development_kit Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthenticated attacker in the adjacent network can exploit this vulnerability to disrupt service. | 0.4% | — |
| CVE-2022-1205 | MED 4.7 | linux linux_kernel A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system. | 0.4% | — |
| CVE-2022-0998 | HIGH 7.8 | linux linux_kernel An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system. | 0.4% | — |
| CVE-2021-42252 | HIGH 7.8 | linux linux_kernel An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, | 0.4% | — |