60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-41850 | HIGH 7.8 | adobe indesign InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v | 0.4% | — |
| CVE-2024-20785 | HIGH 7.8 | adobe indesign InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v | 0.4% | — |
| CVE-2024-20783 | HIGH 7.8 | adobe indesign InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v | 0.4% | — |
| CVE-2023-37454 | MED 5.5 | linux linux_kernel An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective abou | 0.4% | — |
| CVE-2023-2110 | HIGH 8.2 | obsidian obsidian Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens | 0.4% | — |
| CVE-2020-24394 | HIGH 7.1 | canonical ubuntu_linux In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered. | 0.4% | — |
| CVE-2018-15370 | MED 6.8 | cisco ios_rom_monitor A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cisco Secure Boot validation checks and load a compromised software image on an affected device. The vul | 0.4% | — |
| CVE-2017-9496 | MED 6.8 | cisco mx011anm_firmware The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to access an SNMP server by connecting a cable to the Ethernet port, and then establishing communication with the device's link- | 0.4% | — |
| CVE-2016-7474 | MED 5.5 | f5 big-ip_access_policy_manager In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to temporarily obtain normally unrecoverable information. | 0.4% | — |
| CVE-2013-3231 | MED 4.7 | linux linux_kernel The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. | 0.4% | — |
| CVE-2013-2636 | LOW 1.9 | linux linux_kernel net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application. | 0.4% | — |
| CVE-2012-6543 | LOW 1.9 | linux linux_kernel The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. | 0.4% | — |
| CVE-2012-6537 | LOW 1.9 | linux linux_kernel net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability. | 0.4% | — |
| CVE-2010-1083 | MED 4.7 | linux linux_kernel The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically | 0.4% | — |
| CVE-2009-4138 | MED 4.7 | linux linux_kernel drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl asso | 0.4% | — |
| CVE-2008-3247 | HIGH 7.2 | linux linux_kernel The LDT implementation in the Linux kernel 2.6.25.x before 2.6.25.11 on x86_64 platforms uses an incorrect size for ldt_desc, which allows local users to cause a denial of service (system crash) or possibly gain privileges via unspecified vectors. | 0.4% | — |
| CVE-2005-0178 | MED 6.2 | linux linux_kernel Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service (crash) and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores. | 0.4% | — |
| CVE-2026-85848 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-85843 | HIGH 7.8 | microsoft windows_10_1607 Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-85832 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-69383 | HIGH 7.0 | microsoft windows_11_23h2 External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-45634 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows DHCP Server allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-45488 | MED 5.4 | microsoft edge_chromium User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-34031 | MED 6.5 | apache answer Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile | 0.4% | — |
| CVE-2026-20105 | HIGH 7.7 | cisco adaptive_security_appliance_software A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connection to exhaus | 0.4% | — |