60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2010-1436 | MED 4.9 | linux linux_kernel gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-b | 0.4% | — |
| CVE-2009-0834 | LOW 3.6 | canonical ubuntu_linux The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain s | 0.4% | — |
| CVE-2008-3911 | HIGH 7.2 | linux linux_kernel The proc_do_xprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from userspace, which allows local users to overflow a stack-based buffer and have unspecified other impact via a crafted read | 0.4% | — |
| CVE-2005-3806 | MED 6.6 | linux linux_kernel The IPv6 flow label handling code (ip6_flowlabel.c) in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances, which allows local users to corrupt kernel memory or cause a denial of service (crash) by triggeri | 0.4% | — |
| CVE-2004-0447 | HIGH 7.2 | linux linux_kernel Unknown vulnerability in Linux before 2.4.26 for IA64 allows local users to cause a denial of service, with unknown impact. NOTE: due to a typo, this issue was accidentally assigned CVE-2004-0477. This is the proper candidate to use for the Linux local DoS. | 0.4% | — |
| CVE-2026-83944 | CRIT 10.0 | microsoft azure_logic_apps Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2026-83714 | MED 5.5 | microsoft windows_10_1607 Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-76412 | HIGH 8.5 | A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a use | 0.4% | — |
| CVE-2026-70208 | MED 5.5 | microsoft windows_10_1607 Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally. | 0.4% | — |
| CVE-2026-69718 | HIGH 7.8 | microsoft windows_11_23h2 Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally. | 0.4% | — |
| CVE-2026-64035 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.de | 0.4% | — |
| CVE-2026-58283 | HIGH 8.1 | microsoft edge_chromium Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 0.4% | — |
| CVE-2026-53246 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is par | 0.4% | — |
| CVE-2026-49486 | HIGH 7.5 | apache apache-airflow-providers-ftp The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTP | 0.4% | — |
| CVE-2026-46039 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: rxgk: Fix potential integer overflow in length check Fix potential integer overflow in rxgk_extract_token() when checking the length of the ticket. Rather than rounding up the value to be t | 0.4% | — |
| CVE-2026-31636 | CRIT 9.1 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify | 0.4% | — |
| CVE-2026-31536 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the | 0.4% | — |
| CVE-2026-26109 | HIGH 8.4 | microsoft 365_apps Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.4% | — |
| CVE-2026-20009 | MED 5.3 | cisco adaptive_security_appliance_software A vulnerability in the implementation of the proprietary SSH stack with SSH key-based authentication in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to log in to a Cisco Secure Firewall ASA de | 0.4% | — |
| CVE-2025-66769 | HIGH 7.5 | gonitro nitro_pdf_pro A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet. | 0.4% | — |
| CVE-2025-3221 | HIGH 7.5 | ibm infosphere_information_server IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. | 0.4% | — |
| CVE-2025-29842 | HIGH 7.5 | microsoft windows_10_1507 Acceptance of extraneous untrusted data with trusted data in UrlMon allows an unauthorized attacker to bypass a security feature over a network. | 0.4% | — |
| CVE-2025-0130 | HIGH 7.5 | paloaltonetworks pan-os A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeate | 0.4% | — |
| CVE-2024-49097 | HIGH 7.0 | microsoft windows_10_1809 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 0.4% | — |
| CVE-2024-49095 | HIGH 7.0 | microsoft windows_10_1809 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 0.4% | — |