60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-70280 | MED 4.4 | microsoft windows_10_21h2 Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally. | 0.4% | — |
| CVE-2026-35562 | HIGH 7.5 | amazon athena_odbc Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to cause a denial of service by delivering crafted input that triggers excessive resource consumption during the driver's pa | 0.4% | — |
| CVE-2026-20842 | HIGH 7.0 | microsoft windows_10_21h2 Use after free in Windows DWM allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2025-20306 | MED 4.9 | cisco secure_firewall_management_center A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker with Administrator-level privileges to execute arbitrary commands on the underlying operating system. | 0.4% | — |
| CVE-2024-49338 | MED 4.4 | ibm app_connect_enterprise IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials. | 0.4% | — |
| CVE-2024-2432 | MED 4.5 | paloaltonetworks globalprotect A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race c | 0.4% | — |
| CVE-2024-20509 | MED 5.8 | cisco meraki_mx100_firmware A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (DoS) condition for indi | 0.4% | — |
| CVE-2023-47543 | MED 5.4 | fortinet fortiportal An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacker to interact with ressources of other organizations via HTTP or HTTPS requests. | 0.4% | — |
| CVE-2023-26544 | HIGH 7.8 | linux linux_kernel In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. | 0.4% | — |
| CVE-2022-28128 | HIGH 7.8 | hibara attachecase Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory. | 0.4% | — |
| CVE-2022-23283 | HIGH 7.0 | microsoft windows_10 Windows ALPC Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2021-1228 | HIGH 7.4 | cisco nx-os A vulnerability in the fabric infrastructure VLAN connection establishment of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to bypass security validations and connect | 0.4% | — |
| CVE-2020-4005 | HIGH 7.8 | vmware cloud_foundation VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within | 0.4% | — |
| CVE-2020-3423 | MED 5.1 | cisco ios_xe A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system (OS) of an affected de | 0.4% | — |
| CVE-2020-3152 | MED 6.7 | cisco connected_mobile_experiences A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary commands with root privileges. The vulnerability is due to improper user permissions that are configur | 0.4% | — |
| CVE-2019-5666 | HIGH 7.8 | nvidia gpu_driver NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) create context command DDI DxgkDdiCreateContext in which the product uses untrusted input when calculating or using an array index, but the product does not vali | 0.4% | — |
| CVE-2019-15959 | MED 6.6 | cisco spa500_series_ip_phones_firmware A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on t | 0.4% | — |
| CVE-2019-1593 | HIGH 7.8 | cisco nx-os A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by executing commands authorized to other user roles. The attacker must authenticate with valid user creden | 0.4% | — |
| CVE-2019-1585 | MED 6.7 | cisco application_policy_infrastructure_controller_software A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a m | 0.4% | — |
| CVE-2019-12817 | HIGH 7.0 | canonical ubuntu_linux arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc syste | 0.4% | — |
| CVE-2018-0373 | MED 5.5 | cisco anyconnect_secure_mobility_client A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected syste | 0.4% | — |
| CVE-2017-16530 | MED 6.6 | linux linux_kernel The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to drivers/usb/storage/uas-detect.h and drivers/u | 0.4% | — |
| CVE-2015-8844 | MED 5.5 | linux linux_kernel The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. | 0.4% | — |
| CVE-2015-0665 | MED 6.6 | cisco anyconnect_secure_mobility_client The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173. | 0.4% | — |
| CVE-2013-2546 | LOW 2.1 | linux linux_kernel The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN ca | 0.4% | — |