60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-1718 | HIGH 7.1 | ibm db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled. | 0.4% | — |
| CVE-2024-52902 | HIGH 8.8 | ibm cognos_controller IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system. | 0.4% | — |
| CVE-2024-49553 | HIGH 7.8 | adobe media_encoder Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must op | 0.4% | — |
| CVE-2024-49551 | HIGH 7.8 | adobe media_encoder Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must op | 0.4% | — |
| CVE-2024-34099 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in th | 0.4% | — |
| CVE-2024-28775 | MED 4.4 | ibm websphere_automation IBM WebSphere Automation 1.7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessi | 0.4% | — |
| CVE-2024-20442 | MED 5.4 | cisco nexus_dashboard A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls | 0.4% | — |
| CVE-2024-20438 | MED 6.3 | cisco nexus_dashboard A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoint | 0.4% | — |
| CVE-2023-44210 | MED 5.5 | acronis agent Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29258, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 411 | 0.4% | — |
| CVE-2023-23939 | LOW 3.9 | microsoft azure_setup_kubectl Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action be | 0.4% | — |
| CVE-2023-20011 | HIGH 8.8 | cisco application_policy_infrastructure_controller A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request fo | 0.4% | — |
| CVE-2022-2905 | MED 5.5 | debian debian_linux An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. | 0.4% | — |
| CVE-2022-22160 | MED 6.5 | juniper junos An Unchecked Error Condition vulnerability in the subscriber management daemon (smgd) of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a crash of and thereby a Denial of Service (DoS). In a subscriber management / broadband edg | 0.4% | — |
| CVE-2022-20855 | HIGH 7.9 | cisco ios_xe A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the | 0.4% | — |
| CVE-2020-1981 | HIGH 7.0 | paloaltonetworks pan-os A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtual | 0.4% | — |
| CVE-2017-9986 | HIGH 7.8 | linux linux_kernel The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two | 0.4% | — |
| CVE-2017-2341 | HIGH 8.8 | juniper junos An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivileged users on the Junos OS instance to gain access to the host operating environment, and thus escalate privileges. Affec | 0.4% | — |
| CVE-2016-1418 | HIGH 7.8 | cisco aironet_access_point_software_ Cisco Aironet Access Point Software 8.2(100.0) on 1830e, 1830i, 1850e, 1850i, 2800, and 3800 access points allows local users to obtain Linux root access via crafted CLI command parameters, aka Bug ID CSCuy64037. | 0.4% | — |
| CVE-2015-1420 | LOW 1.9 | debian debian_linux Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file han | 0.4% | — |
| CVE-2011-1078 | LOW 1.9 | linux linux_kernel The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option. | 0.4% | — |
| CVE-2026-88209 | MED 4.6 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-85856 | HIGH 7.1 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network. | 0.4% | — |
| CVE-2026-70354 | HIGH 7.8 | microsoft .net Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-58542 | HIGH 7.8 | microsoft windows_11_24h2 Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-58530 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally. | 0.4% | — |