58.650 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.650 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-20126 | CRIT 9.8 | cisco spa112_firmware A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within th | 36.7% | — |
| CVE-2003-0111 | HIGH 7.5 | microsoft virtual_machine The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Micro | 36.7% | — |
| CVE-2025-54988 | HIGH 8.4 | apache tika Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitiv | 36.7% | — |
| CVE-2023-28231 | HIGH 8.8 | microsoft windows_server_2008 DHCP Server Service Remote Code Execution Vulnerability | 36.6% | — |
| CVE-2016-6435 | MED 6.5 | cisco secure_firewall_management_center The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376. | 36.6% | — |
| CVE-2009-0901 | HIGH 8.8 | microsoft visual_c\+\+ The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Go | 36.6% | — |
| CVE-2007-0352 | HIGH 9.3 | microsoft html_help_workshop Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a crafted .cnt file composed of lines that begin with an integer followed by a space and a long string. | 36.6% | — |
| CVE-2008-6504 | MED 5.0 | apache struts ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph N | 36.6% | — |
| CVE-2007-3490 | HIGH 7.5 | microsoft excel Unspecified vulnerability in Microsoft Excel 2003 SP2 allows remote attackers to have an unknown impact via unspecified vectors, possibly related to the sheet name, as demonstrated by 2670.xls. | 36.6% | — |
| CVE-2020-11981 | CRIT 9.8 | apache airflow An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands. | 36.5% | — |
| CVE-2017-0084 | HIGH 8.8 | microsoft windows_10 Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary cod | 36.5% | — |
| CVE-2003-0824 | MED 5.0 | microsoft frontpage_server_extensions Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. | 36.5% | — |
| CVE-2020-17144 | HIGH 8.4 | microsoft exchange_server Microsoft Exchange Remote Code Execution Vulnerability | 36.5% | |
| CVE-2019-17564 | CRIT 9.8 | apache dubbo Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue aff | 36.5% | — |
| CVE-2016-4232 | HIGH 7.5 | adobe flash_player Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to obtain sensitive information from process memory via unspecified vectors. | 36.5% | — |
| CVE-2018-4985 | HIGH 7.5 | adobe acrobat_dc Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 36.4% | — |
| CVE-2023-46217 | CRIT 9.8 | ivanti avalanche An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | 36.4% | — |
| CVE-2023-46216 | CRIT 9.8 | ivanti avalanche An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | 36.4% | — |
| CVE-2023-41727 | CRIT 9.8 | ivanti avalanche An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | 36.4% | — |
| CVE-2015-2461 | HIGH 9.3 | microsoft windows_10 ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to e | 36.4% | — |
| CVE-2016-3259 | HIGH 8.8 | microsoft edge The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corrupt | 36.4% | — |
| CVE-2012-0393 | MED 6.4 | apache struts The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object. | 36.3% | — |
| CVE-2006-5581 | HIGH 9.3 | microsoft internet_explorer Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Me | 36.3% | — |
| CVE-2012-0284 | HIGH 9.3 | cisco linksys_playerpt_activex_control Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first ar | 36.3% | — |
| CVE-2024-43464 | HIGH 7.2 | microsoft sharepoint_server Microsoft SharePoint Server Remote Code Execution Vulnerability | 36.3% | — |