60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-4935 | HIGH 7.8 | vmware horizon_view VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds write vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Serv | 0.4% | — |
| CVE-2017-4898 | HIGH 8.8 | vmware workstation_player VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a path defined in the local environment-variable. Successful exploitation of this issue may allow normal users t | 0.4% | — |
| CVE-2017-17857 | HIGH 7.8 | debian debian_linux The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read | 0.4% | — |
| CVE-2017-17856 | HIGH 7.8 | debian debian_linux kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement. | 0.4% | — |
| CVE-2017-16525 | MED 6.6 | canonical ubuntu_linux The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, r | 0.4% | — |
| CVE-2016-9685 | MED 5.5 | linux linux_kernel Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations. | 0.4% | — |
| CVE-2016-5870 | HIGH 7.8 | linux linux_kernel The msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c in the ipc_router component for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a deni | 0.4% | — |
| CVE-2015-8845 | MED 5.5 | linux linux_kernel The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (T | 0.4% | — |
| CVE-2015-6526 | MED 4.9 | linux linux_kernel The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace. | 0.4% | — |
| CVE-2010-4163 | MED 4.7 | linux linux_kernel The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.36.2 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device. | 0.4% | — |
| CVE-2010-4162 | MED 4.7 | fedoraproject fedora Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device. | 0.4% | — |
| CVE-2010-4081 | LOW 1.9 | debian debian_linux The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCT | 0.4% | — |
| CVE-2009-2691 | LOW 2.1 | linux linux_kernel The mm_for_maps function in fs/proc/base.c in the Linux kernel 2.6.30.4 and earlier allows local users to read (1) maps and (2) smaps files under proc/ via vectors related to ELF loading, a setuid process, and a race condition. | 0.4% | — |
| CVE-2008-4279 | MED 6.8 | vmware esx The CPU hardware emulation for 64-bit guest operating systems in VMware Workstation 6.0.x before 6.0.5 build 109488 and 5.x before 5.5.8 build 108000; Player 2.0.x before 2.0.5 build 109488 and 1.x before 1.0.8; Server 1.x before 1.0.7 build 108231; and ESX 2. | 0.4% | — |
| CVE-2005-1764 | LOW 2.1 | linux linux_kernel Linux 2.6.11 on 64-bit x86 (x86_64) platforms does not use a guard page for the 47-bit address page to protect against an AMD K8 bug, which allows local users to cause a denial of service. | 0.4% | — |
| CVE-2004-0496 | HIGH 7.2 | gentoo linux Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel memory, a different set of vulnerabilities than those identified in CVE-2004-0495, as found by the Sparse source code checking tool. | 0.4% | — |
| CVE-2026-83765 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-83668 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows WLAN Service allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-83664 | MED 5.5 | microsoft windows_10_1607 Access of resource using incompatible type ('type confusion') in Windows Portable Device File System Driver allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-76390 | MED 5.3 | cisco talos_intelligence_for_enterprise_security_cloud In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on R | 0.4% | — |
| CVE-2026-70255 | HIGH 7.8 | microsoft windows_10_1809 Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-53006 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(sk | 0.4% | — |
| CVE-2026-43646 | HIGH 7.5 | apache wicket Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, | 0.4% | — |
| CVE-2026-40967 | HIGH 8.6 | vmware spring_ai In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query | 0.4% | — |
| CVE-2026-34059 | HIGH 7.5 | apache http_server Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue. | 0.4% | — |