57.056 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.056 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-19171 | CRIT 9.6 | google chrome Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-15773 | CRIT 9.6 | google chrome Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-12878 | HIGH 8.8 | octopus codefresh In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions. | 0.4% | — |
| CVE-2025-62826 | LOW 3.1 | fortinet fortios An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiPro | 0.4% | — |
| CVE-2025-58719 | MED 4.7 | microsoft windows_10_1607 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-49694 | HIGH 7.8 | microsoft windows_11_24h2 Null pointer dereference in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-49693 | HIGH 7.8 | microsoft windows_11_22h2 Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-47986 | HIGH 8.8 | microsoft windows_10_1507 Use after free in Universal Print Management Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-38437 | HIGH 8.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could ca | 0.4% | — |
| CVE-2024-56656 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of the previous generation (5750X or P5). However, the agg | 0.4% | — |
| CVE-2024-35969 | HIGH 8.8 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an ite | 0.4% | — |
| CVE-2024-35278 | MED 4.3 | fortinet fortiportal A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting | 0.4% | — |
| CVE-2024-20792 | HIGH 7.8 | adobe illustrator Illustrator versions 28.4, 27.9.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mal | 0.4% | — |
| CVE-2023-41743 | HIGH 7.8 | acronis agent Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber | 0.4% | — |
| CVE-2023-38212 | HIGH 7.8 | adobe dimension Adobe Dimension version 3.4.9 is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a maliciou | 0.4% | — |
| CVE-2023-29368 | HIGH 7.0 | microsoft windows_10_1507 Windows Filtering Platform Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2023-29364 | HIGH 7.0 | microsoft windows_10_1507 Windows Authentication Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2023-28216 | HIGH 7.0 | microsoft windows_10_1507 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2023-26605 | HIGH 7.8 | linux linux_kernel In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid. | 0.4% | — |
| CVE-2023-24068 | HIGH 7.8 | signal signal-desktop Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting in an attacker's abili | 0.4% | — |
| CVE-2022-41291 | MED 6.5 | ibm infosphere_information_server IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699. | 0.4% | — |
| CVE-2022-22179 | MED 6.5 | juniper junos A Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a crash of jdhcpd and thereby a Denial of Service (DoS). | 0.4% | — |
| CVE-2021-29816 | MED 6.5 | ibm jazz_for_service_management IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: | 0.4% | — |
| CVE-2021-23134 | HIGH 7.8 | debian debian_linux Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability. | 0.4% | — |
| CVE-2021-1452 | MED 6.8 | cisco ios_xe_rom_monitor A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauthe | 0.4% | — |