57.415 CVE tracked
782 Exploited now
187 Used by ransomware
Last sync
CVE Tracker
57.415 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-40727 | HIGH 7.8 | adobe indesign Access of Memory Location After End of Buffer (CWE-788 | 1.5% | — |
| CVE-2020-4879 | CRIT 9.8 | ibm cognos_controller IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847. | 1.5% | — |
| CVE-1999-0628 | MED 5.0 | freebsd freebsd The rwho/rwhod service is running, which exposes machine status and user information. | 1.5% | — |
| CVE-2022-20714 | HIGH 8.6 | cisco ios_xr A vulnerability in the data plane microcode of Lightspeed-Plus line cards for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the line card to reset. This vulnerability is due to the incorrect handlin | 1.5% | — |
| CVE-2021-27193 | CRIT 9.8 | netop vision_pro Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write files on the remote machine with system privileges resulting in a privilege escalation. | 1.5% | — |
| CVE-2019-1640 | HIGH 7.8 | cisco webex_meetings_online A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software im | 1.5% | — |
| CVE-2019-1639 | HIGH 7.8 | cisco webex_meetings_online A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software im | 1.5% | — |
| CVE-2019-1638 | HIGH 7.8 | cisco webex_meetings_online A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software im | 1.5% | — |
| CVE-2019-1637 | HIGH 7.8 | cisco webex_meetings_online A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software im | 1.5% | — |
| CVE-2017-2493 | MED 6.5 | apple icloud An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to byp | 1.5% | — |
| CVE-2011-0244 | MED 4.3 | apple safari WebKit in Apple Safari before 5.0.6 allows user-assisted remote attackers to read arbitrary files via vectors related to improper canonicalization of URLs within RSS feeds. | 1.5% | — |
| CVE-2010-4165 | MED 4.9 | linux linux_kernel The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, lead | 1.5% | — |
| CVE-2020-17046 | MED 5.5 | microsoft windows_10 Windows Error Reporting Denial of Service Vulnerability | 1.5% | — |
| CVE-2017-9796 | MED 5.3 | apache geode When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorize | 1.5% | — |
| CVE-2017-3822 | MED 5.3 | cisco secure_firewall_threat_defense A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense (FTD) Firepower Device Manager (FDM) could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This vulnerability affects Cisco Firepower Threat Def | 1.5% | — |
| CVE-2025-47962 | HIGH 7.8 | microsoft windows_software_development_kit Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally. | 1.5% | — |
| CVE-2023-25539 | HIGH 8.4 | dell networker Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying | 1.5% | — |
| CVE-2018-4309 | MED 6.1 | apple icloud A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. | 1.5% | — |
| CVE-2017-5087 | HIGH 8.8 | google chrome A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, aka an IndexedDB sandbox escape. | 1.5% | — |
| CVE-2000-0777 | HIGH 7.2 | microsoft money The password protection feature of Microsoft Money can store the password in plaintext, which allows attackers with physical access to the system to obtain the password, aka the "Money Password" vulnerability. | 1.5% | — |
| CVE-2024-37385 | CRIT 9.8 | roundcube webmail Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641. | 1.5% | — |
| CVE-2020-1474 | HIGH 7.8 | microsoft windows_10 An information disclosure vulnerability exists when the Windows Image Acquisition (WIA) Service improperly discloses contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s syst | 1.5% | — |
| CVE-2018-0462 | MED 4.9 | cisco enterprise_network_virtualization_software A vulnerability in the user management functionality of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a denial of service (DoS) attack against an affected system. The vulnerability is due to insuf | 1.5% | — |
| CVE-2017-0463 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Qualcomm networking driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged pro | 1.5% | — |
| CVE-2025-27487 | HIGH 8.0 | microsoft remote_desktop_client Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network. | 1.5% | — |