60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-35829 | HIGH 7.0 | linux linux_kernel An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c. | 0.4% | — |
| CVE-2023-0007 | MED 6.5 | paloaltonetworks pan-os A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrat | 0.4% | — |
| CVE-2021-42754 | LOW 3.2 | fortinet forticlient An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file. | 0.4% | — |
| CVE-2021-32596 | MED 6.0 | fortinet fortiportal A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to decrypt the passwords by means of precomputed tables. | 0.4% | — |
| CVE-2020-28572 | HIGH 7.8 | trendmicro apex_one A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege. | 0.4% | — |
| CVE-2020-16119 | MED 6.3 | canonical ubuntu_linux Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4 | 0.4% | — |
| CVE-2018-12928 | MED 5.5 | canonical ubuntu_linux In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem. | 0.4% | — |
| CVE-2018-0302 | HIGH 7.8 | cisco firepower_extensible_operating_system A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to incorrect input validation in the CLI | 0.4% | — |
| CVE-2017-4904 | HIGH 8.8 | vmware esxi The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation | 0.4% | — |
| CVE-2017-12336 | MED 4.2 | cisco nx-os A vulnerability in the TCL scripting subsystem of Cisco NX-OS System Software could allow an authenticated, local attacker to escape the interactive TCL shell and gain unauthorized access to the underlying operating system of the device. The vulnerability exis | 0.4% | — |
| CVE-2010-4169 | MED 4.9 | fedoraproject fedora Use-after-free vulnerability in mm/mprotect.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors involving an mprotect system call. | 0.4% | — |
| CVE-2009-1072 | MED 4.9 | canonical ubuntu_linux nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option. | 0.4% | — |
| CVE-2008-2944 | MED 4.9 | fedoraproject fedora_core Double free vulnerability in the utrace support in the Linux kernel, probably 2.6.18, in Red Hat Enterprise Linux (RHEL) 5 and Fedora Core 6 (FC6) allows local users to cause a denial of service (oops), as demonstrated by a crash when running the GNU GDB tests | 0.4% | — |
| CVE-2008-1931 | MED 6.8 | realtek hd_audio_codec_drivers Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allow local users to create, write, and read registry keys via a crafted IOCTL request. | 0.4% | — |
| CVE-2006-5619 | LOW 2.1 | linux linux_kernel The seqfile handling (ip6fl_get_n function in ip6_flowlabel.c) in Linux kernel 2.6 up to 2.6.18-stable allows local users to cause a denial of service (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels. | 0.4% | — |
| CVE-2006-3589 | LOW 3.6 | vmware esx vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL ke | 0.4% | — |
| CVE-2004-0138 | MED 4.9 | linux linux_kernel The ELF loader in Linux kernel 2.4 before 2.4.25 allows local users to cause a denial of service (crash) via a crafted ELF file with an interpreter with an invalid arch (architecture), which triggers a BUG() when an invalid VMA is unmapped. | 0.4% | — |
| CVE-2001-1393 | LOW 2.1 | linux linux_kernel Unknown vulnerability in classifier code for Linux kernel before 2.2.19 could result in denial of service (hang). | 0.4% | — |
| CVE-2001-1392 | LOW 2.1 | linux linux_kernel The Linux kernel before 2.2.19 does not have unregister calls for (1) CPUID and (2) MSR drivers, which could cause a DoS (crash) by unloading and reloading the drivers. | 0.4% | — |
| CVE-2026-47889 | HIGH 7.5 | vmware spring_framework A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 | 0.4% | — |
| CVE-2026-4680 | HIGH 8.8 | google chrome Use after free in FedCM in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2026-45649 | HIGH 7.1 | microsoft excel Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally. | 0.4% | — |
| CVE-2026-28373 | CRIT 9.6 | stackfield stackfield The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesys | 0.4% | — |
| CVE-2026-20050 | MED 6.8 | cisco secure_firewall_threat_defense A vulnerability in the Do Not Decrypt exclusion feature of the SSL decryption feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. | 0.4% | — |
| CVE-2026-19489 | ND | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21. | 0.4% | — |