60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-0526 | MED 5.4 | octopus octopus_server In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows. | 0.4% | — |
| CVE-2025-0104 | MED 6.1 | paloaltonetworks expedition A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that al | 0.4% | — |
| CVE-2024-26194 | HIGH 7.4 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.4% | — |
| CVE-2022-45458 | HIGH 7.5 | acronis agent Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 29633, Acronis Cyber Protect 15 (Windows, macOS, Linux) before build 30984. | 0.4% | — |
| CVE-2022-45457 | HIGH 7.5 | acronis agent Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows) before build 29633, Acronis Cyber Protect 15 (Windows) before build 30984. | 0.4% | — |
| CVE-2022-27050 | HIGH 7.8 | bitcomet bitcomet BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system level. | 0.4% | — |
| CVE-2022-20696 | HIGH 7.5 | cisco catalyst_sd-wan_manager A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system. This vulnera | 0.4% | — |
| CVE-2021-1065 | HIGH 7.1 | nvidia virtual_gpu_manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data or denial of service. This affects vGPU version 8.x (prior to 8.6) and version 11.0 (prior to 11.3). | 0.4% | — |
| CVE-2020-3237 | MED 6.3 | cisco iox A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, local attacker to overwrite arbitrary files in the virtual instance that is running on the affected device. The vulnerability is | 0.4% | — |
| CVE-2019-0009 | MED 5.5 | juniper junos On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This iss | 0.4% | — |
| CVE-2016-1390 | HIGH 7.8 | cisco prime_network_analysis_module_software Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow local users to obtain root access via crafted CLI i | 0.4% | — |
| CVE-2015-7751 | MED 6.9 | juniper junos Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D105, 14 | 0.4% | — |
| CVE-2013-1928 | MED 4.7 | linux linux_kernel The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET | 0.4% | — |
| CVE-2011-1474 | MED 5.5 | linux linux_kernel A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-test14.patch. A bad bounds check in arch_get_unmapped_area_topdown triggered by programs doing an mmap after a MAP_GROWSDOW | 0.4% | — |
| CVE-2011-1080 | LOW 2.1 | linux linux_kernel The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by | 0.4% | — |
| CVE-2005-1368 | LOW 1.2 | linux linux_kernel The key_user_lookup function in security/keys/key.c in Linux kernel 2.6.10 to 2.6.11.8 may allow attackers to cause a denial of service (oops) via SMP. | 0.4% | — |
| CVE-2026-7359 | HIGH 8.8 | google chrome Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-7354 | HIGH 8.8 | google chrome Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-5859 | HIGH 8.8 | google chrome Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | 0.4% | — |
| CVE-2026-49871 | CRIT 9.3 | apache apisix Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a | 0.4% | — |
| CVE-2026-47849 | HIGH 7.1 | vmware spring_data_rest Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Dat | 0.4% | — |
| CVE-2026-32073 | HIGH 7.0 | microsoft windows_10_1607 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-24290 | HIGH 7.8 | microsoft windows_10_1809 Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-60717 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-59515 | HIGH 7.0 | microsoft windows_10_1809 Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |