60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2011-3124 | HIGH 7.2 | ibm infosphere_datastage IBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere DataStage 8.5 and 8.5.0.1 and other products, assigns incorrect ownership to unspecified files, which allows local users to gain privileges via unknown vectors. | 0.4% | — |
| CVE-2011-3123 | HIGH 7.2 | ibm infosphere_datastage IBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere DataStage 8.5 and 8.5.0.1 and other products, uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors. | 0.4% | — |
| CVE-2009-4410 | MED 4.9 | linux linux_kernel The fuse_ioctl_copy_user function in the ioctl handler in fs/fuse/file.c in the Linux kernel 2.6.29-rc1 through 2.6.30.y uses the wrong variable in an argument to the kunmap function, which allows local users to cause a denial of service (panic) via unknown ve | 0.4% | — |
| CVE-2009-1388 | MED 5.5 | linux linux_kernel The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function, which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call a | 0.4% | — |
| CVE-2026-9114 | HIGH 8.8 | google chrome Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-70052 | HIGH 7.8 | microsoft windows_11_23h2 Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-6307 | HIGH 8.8 | google chrome Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-4676 | HIGH 8.8 | google chrome Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-4457 | HIGH 8.8 | google chrome Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-42812 | CRIT 9.9 | apache polaris In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `write.metadata.path` is an optional table property that tells Polaris where to write those metadata fil | 0.4% | — |
| CVE-2026-108136 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102220 | HIGH 7.8 | microsoft windows_10_1607 Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102218 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102216 | HIGH 7.8 | microsoft windows_10_1607 Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102215 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102205 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102201 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102196 | HIGH 7.8 | microsoft windows_10_1809 Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-102186 | MED 4.7 | microsoft windows_10_1607 Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-24036 | HIGH 7.0 | microsoft autoupdate Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2025-22855 | LOW 2.7 | fortinet forticlientems An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code. | 0.4% | — |
| CVE-2024-5828 | HIGH 8.6 | hitachi tuning_manager Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00. | 0.4% | — |
| CVE-2024-47712 | HIGH 8.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param In the `wilc_parse_join_bss_param` function, the TSF field of the `ies` structure is accessed after the RCU r | 0.4% | — |
| CVE-2024-39389 | HIGH 7.8 | adobe indesign InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a | 0.4% | — |
| CVE-2024-31489 | MED 6.8 | fortinet forticlient AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 through 7.0.11, 7.2.0 through 7.2.4 may allow a remote and unaut | 0.4% | — |