57.361 CVE tracked
782 Exploited now
186 Used by ransomware
Last sync
CVE Tracker
57.361 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-6472 | MED 6.1 | cisco unified_communications_manager A vulnerability in several parameters of the ccmivr page of Cisco Unified Communication Manager (CallManager) could allow an unauthenticated, remote attacker to launch a cross-site scripting (XSS) attack against a user of the web interface on the affected syst | 1.5% | — |
| CVE-2016-1423 | MED 6.1 | cisco email_security_appliance A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a user to click a malicious link in the MIQ view. The m | 1.5% | — |
| CVE-2014-3363 | LOW 3.5 | cisco unified_communications_manager Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443. | 1.5% | — |
| CVE-2020-8210 | HIGH 7.5 | citrix xenmobile_server Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account. | 1.5% | — |
| CVE-2017-14397 | CRIT 9.8 | anydesk anydesk AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability. | 1.5% | — |
| CVE-2017-0524 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged p | 1.5% | — |
| CVE-2017-0519 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Qualcomm fingerprint sensor driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privil | 1.5% | — |
| CVE-2017-0456 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Qualcomm IPA driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. P | 1.5% | — |
| CVE-2014-8643 | HIGH 7.1 | mozilla firefox Mozilla Firefox before 35.0 on Windows allows remote attackers to bypass the Gecko Media Plugin (GMP) sandbox protection mechanism by leveraging access to the GMP process, as demonstrated by the OpenH264 plugin's process. | 1.5% | — |
| CVE-2014-3292 | MED 5.5 | cisco unified_communications_manager The Real Time Monitoring Tool (RTMT) implementation in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to (1) read or (2) delete arbitrary files via a crafted URL, aka Bug IDs CSCuo17302 and CSCuo17199. | 1.5% | — |
| CVE-2010-4073 | LOW 1.9 | debian debian_linux The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgct | 1.5% | — |
| CVE-2026-20875 | HIGH 7.5 | microsoft windows_10_1607 Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. | 1.5% | — |
| CVE-2018-8164 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 20 | 1.5% | — |
| CVE-2017-8557 | MED 5.5 | microsoft windows_10 Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability imp | 1.5% | — |
| CVE-2016-7911 | HIGH 7.8 | linux linux_kernel Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call. | 1.5% | — |
| CVE-2014-3339 | MED 6.5 | cisco unified_communications_domain_manager Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to execute arbitrary SQL commands via crafted input to unspecified | 1.5% | — |
| CVE-2007-6051 | HIGH 10.0 | ibm db2_universal_database IBM DB2 UDB 9.1 before Fixpak 4 assigns incorrect privileges to the (1) DB2ADMNS and (2) DB2USERS alternative groups, which has unknown impact. NOTE: the vendor description of this issue is too vague to be certain that it is security-related. | 1.5% | — |
| CVE-2022-37975 | HIGH 8.8 | microsoft windows_10 Windows Group Policy Elevation of Privilege Vulnerability | 1.5% | — |
| CVE-2021-39835 | MED 4.3 | adobe framemaker Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed PDF file that could result in disclosure of sensitive memory. Exploitation of this iss | 1.5% | — |
| CVE-2021-3059 | HIGH 8.1 | paloaltonetworks pan-os An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impa | 1.5% | — |
| CVE-2021-26629 | HIGH 8.8 | tobesoft xplatform A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..\’. | 1.5% | — |
| CVE-2020-8211 | CRIT 9.8 | citrix xenmobile_server Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows SQL Injection. | 1.5% | — |
| CVE-2013-3441 | MED 5.4 | cisco aironet_3600 Cisco Aironet 3600 access points allow remote attackers to cause a denial of service (memory corruption and device crash) by disrupting Cisco Wireless LAN Controller communication and consequently forcing many transitions from FlexConnect mode to Standalone mo | 1.5% | — |
| CVE-2006-2322 | MED 6.4 | cisco application_velocity_system_3110 The transparent proxy feature of the Cisco Application Velocity System (AVS) 3110 5.0 and 4.0 and earlier, and 3120 5.0.0 and earlier, has a default configuration that allows remote attackers to proxy arbitrary TCP connections, aka Bug ID CSCsd32143. | 1.5% | — |
| CVE-2026-61400 | HIGH 8.8 | apache cloudstack Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to in | 1.5% | — |