60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-59504 | HIGH 7.3 | microsoft azure_monitor_agent Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-58737 | HIGH 7.0 | microsoft windows_server_2012 Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2025-55334 | MED 6.2 | microsoft windows_11_22h2 Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2025-47991 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-4525 | HIGH 7.0 | discord discord A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approac | 0.4% | — |
| CVE-2025-27907 | MED 4.1 | ibm websphere_application_server IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | 0.4% | — |
| CVE-2025-0124 | LOW 3.8 | paloaltonetworks pan-os An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configura | 0.4% | — |
| CVE-2024-20383 | MED 4.8 | cisco asyncos A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insuf | 0.4% | — |
| CVE-2023-33203 | MED 6.4 | linux linux_kernel The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device. | 0.4% | — |
| CVE-2022-20804 | MED 5.3 | cisco unified_communications_manager A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, adjacent attacker to cause a kernel panic | 0.4% | — |
| CVE-2022-20660 | MED 4.6 | cisco ip_conference_phone_7832_firmware A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confident | 0.4% | — |
| CVE-2021-47028 | HIGH 7.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fix txrate reporting Properly check rate_info to fix unexpected reporting. [ 1215.161863] Call trace: [ 1215.164307] cfg80211_calculate_bitrate+0x124/0x200 [cfg80211] [ 1215. | 0.4% | — |
| CVE-2021-23002 | MED 4.5 | f5 access_policy_manager_clients When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session | 0.4% | — |
| CVE-2020-3379 | HIGH 7.8 | cisco sd-wan_firmware A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this | 0.4% | — |
| CVE-2017-6705 | MED 5.5 | cisco prime_collaboration_provisioning A vulnerability in the filesystem of the Cisco Prime Collaboration Provisioning tool could allow an authenticated, local attacker to acquire sensitive information. More Information: CSCvc82973. Known Affected Releases: 12.1. | 0.4% | — |
| CVE-2016-5328 | MED 5.5 | vmware tools VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vectors. | 0.4% | — |
| CVE-2015-8839 | MED 5.1 | canonical ubuntu_linux Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punchi | 0.4% | — |
| CVE-2012-4108 | MED 6.8 | cisco unified_computing_system The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges and execute arbitrary operating-system commands via crafted parameters to a file-related command, aka Bug ID CSCtq86554. | 0.4% | — |
| CVE-2012-2669 | LOW 2.1 | linux linux_kernel The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message. | 0.4% | — |
| CVE-2012-1097 | HIGH 7.8 | linux linux_kernel The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact vi | 0.4% | — |
| CVE-2009-0024 | HIGH 7.2 | linux linux_kernel The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm_file structure member, and the mmap_region and do_munmap function | 0.4% | — |
| CVE-2008-3485 | HIGH 7.2 | citrix metaframe_presentation_server Untrusted search path vulnerability in Citrix MetaFrame Presentation Server allows local users to gain privileges via a malicious icabar.exe placed in the search path. | 0.4% | — |
| CVE-2007-6049 | HIGH 7.2 | ibm db2_universal_database Unspecified vulnerability in the SSL LOAD GSKIT action in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors, involving a call to dlopen when the effective uid is root. | 0.4% | — |
| CVE-2007-2480 | MED 4.6 | linux linux_kernel The _udp_lib_get_port function in net/ipv4/udp.c in Linux kernel 2.6.21 and earlier does not prevent a bind to a port with a local address when there is already a bind to that port with a wildcard local address, which might allow local users to intercept local | 0.4% | — |
| CVE-2026-85811 | HIGH 7.5 | microsoft windows_10_1607 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network. | 0.4% | — |