60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-3545 | MED 5.5 | debian debian_linux A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use | 0.4% | — |
| CVE-2022-35285 | HIGH 8.8 | ibm security_verify_information_queue IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230812. | 0.4% | — |
| CVE-2022-32296 | LOW 3.3 | linux linux_kernel The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056. | 0.4% | — |
| CVE-2021-43080 | MED 4.6 | fortinet fortios An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack t | 0.4% | — |
| CVE-2019-1836 | HIGH 7.1 | cisco nx-os A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to use symbolic links to overwrite system files. These system files may be sensitive a | 0.4% | — |
| CVE-2019-12455 | MED 5.5 | linux linux_kernel An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked kstrndup of derived_name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system | 0.4% | — |
| CVE-2017-6347 | HIGH 7.8 | linux linux_kernel The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout, which allows local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact | 0.4% | — |
| CVE-2017-14187 | MED 6.2 | fortinet fortios A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attacker to execute unauthorized binary program contained on an USB drive plugged into a FortiGate via lin | 0.4% | — |
| CVE-2015-4237 | MED 4.6 | cisco nx-os The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CS | 0.4% | — |
| CVE-2009-3288 | MED 4.9 | kernel linux_kernel The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstra | 0.4% | — |
| CVE-2006-3741 | MED 4.9 | linux linux_kernel The perfmonctl system call (sys_perfmonctl) in Linux kernel 2.4.x and 2.6 before 2.6.18, when running on Itanium systems, does not properly track the reference count for file descriptors, which allows local users to cause a denial of service (file descriptor c | 0.4% | — |
| CVE-2006-1528 | MED 4.9 | linux linux_kernel Linux kernel before 2.6.13 allows local users to cause a denial of service (crash) via a dio transfer from the sg driver to memory mapped (mmap) IO space. | 0.4% | — |
| CVE-2005-4412 | LOW 2.1 | citrix program_neighborhood_client Citrix Program Neighborhood client before 9.150 caches the user password in plaintext in the GUI while asterisks are used to visually obfuscate the password, which allows attackers with access to the session to obtain the password by using a tool to directly a | 0.4% | — |
| CVE-2026-83892 | MED 5.5 | microsoft windows_10_1809 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-83884 | MED 5.5 | microsoft windows_10_1809 Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2025-66236 | HIGH 7.5 | apache airflow Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not cle | 0.4% | — |
| CVE-2025-59790 | MED 5.4 | apache kvrocks Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue. | 0.4% | — |
| CVE-2025-48001 | MED 6.8 | microsoft windows_10_1507 Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | 0.4% | — |
| CVE-2025-36546 | HIGH 8.1 | f5 f5os-a On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is still allowed. For an attacker to exploit this vulnerability t | 0.4% | — |
| CVE-2025-20183 | MED 5.8 | cisco asyncos A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious fil | 0.4% | — |
| CVE-2025-13630 | HIGH 8.8 | google chrome Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 0.4% | — |
| CVE-2024-44973 | HIGH 8.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call do_slab_free for kfence object In 782f8906f805 the freeing of kfence objects was moved from deep inside do_slab_free to the wrapper functions outside. This is a nice ch | 0.4% | — |
| CVE-2024-32123 | MED 6.7 | fortinet fortianalyzer Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6. | 0.4% | — |
| CVE-2024-20737 | MED 5.5 | adobe after_effects After Effects versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue | 0.4% | — |
| CVE-2023-28262 | HIGH 7.8 | microsoft visual_studio_2019 Visual Studio Elevation of Privilege Vulnerability | 0.4% | — |