57.065 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.065 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-78329 | CRIT 9.8 | apache camel Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the | 0.4% | — |
| CVE-2026-41086 | HIGH 8.8 | microsoft windows_admin_center Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2026-40403 | HIGH 8.8 | microsoft windows_10_1607 Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-24687 | MED 6.5 | umbraco umbraco_forms Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco install | 0.4% | — |
| CVE-2025-59280 | LOW 3.1 | microsoft windows_10_1507 Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network. | 0.4% | — |
| CVE-2025-27391 | MED 6.5 | apache artemis Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issu | 0.4% | — |
| CVE-2025-21959 | HIGH 7.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), `cpu` and `ji | 0.4% | — |
| CVE-2024-38158 | HIGH 7.0 | microsoft azure_iot_hub_device_client_sdk Azure IoT SDK Remote Code Execution Vulnerability | 0.4% | — |
| CVE-2024-38136 | HIGH 7.0 | microsoft windows_10_1809 Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2024-22340 | MED 6.5 | ibm common_cryptographic_architecture IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack. | 0.4% | — |
| CVE-2023-35829 | HIGH 7.0 | linux linux_kernel An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c. | 0.4% | — |
| CVE-2023-0007 | MED 6.5 | paloaltonetworks pan-os A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrat | 0.4% | — |
| CVE-2022-50401 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and | 0.4% | — |
| CVE-2022-2318 | MED 5.5 | debian debian_linux There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges. | 0.4% | — |
| CVE-2021-42754 | LOW 3.2 | fortinet forticlient An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file. | 0.4% | — |
| CVE-2021-32596 | MED 6.0 | fortinet fortiportal A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to decrypt the passwords by means of precomputed tables. | 0.4% | — |
| CVE-2020-28572 | HIGH 7.8 | trendmicro apex_one A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege. | 0.4% | — |
| CVE-2018-5518 | MED 5.4 | f5 big-ip_access_policy_manager On F5 BIG-IP 13.0.0-13.1.0.5 or 12.0.0-12.1.3.3, malicious root users with access to a VCMP guest can cause a disruption of service on adjacent VCMP guests running on the same host. Exploiting this vulnerability causes the vCMPd process on the adjacent VCMP gu | 0.4% | — |
| CVE-2018-16885 | MED 4.7 | linux linux_kernel A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a sys | 0.4% | — |
| CVE-2018-12930 | HIGH 7.8 | canonical ubuntu_linux ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted nt | 0.4% | — |
| CVE-2018-12928 | MED 5.5 | canonical ubuntu_linux In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem. | 0.4% | — |
| CVE-2018-0302 | HIGH 7.8 | cisco firepower_extensible_operating_system A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to incorrect input validation in the CLI | 0.4% | — |
| CVE-2017-6143 | MED 5.4 | f5 big-ip_advanced_firewall_manager X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5. | 0.4% | — |
| CVE-2017-4904 | HIGH 8.8 | vmware esxi The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation | 0.4% | — |
| CVE-2017-12336 | MED 4.2 | cisco nx-os A vulnerability in the TCL scripting subsystem of Cisco NX-OS System Software could allow an authenticated, local attacker to escape the interactive TCL shell and gain unauthorized access to the underlying operating system of the device. The vulnerability exis | 0.4% | — |