57.415 CVE tracked
782 Exploited now
187 Used by ransomware
Last sync
CVE Tracker
57.415 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-49003 | HIGH 8.8 | microsoft sql_server_2016 SQL Server Native Client Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2024-49002 | HIGH 8.8 | microsoft sql_server_2016 SQL Server Native Client Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2024-49001 | HIGH 8.8 | microsoft sql_server_2016 SQL Server Native Client Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2024-49000 | HIGH 8.8 | microsoft sql_server_2016 SQL Server Native Client Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2021-42761 | CRIT 9.0 | fortinet fortiweb A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticat | 1.5% | — |
| CVE-2019-1927 | HIGH 7.8 | cisco webex_business_suite Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software | 1.5% | — |
| CVE-2019-1924 | HIGH 7.8 | cisco webex_business_suite Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software | 1.5% | — |
| CVE-2019-1259 | HIGH 8.8 | microsoft sharepoint_foundation A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page specifically designed t | 1.5% | — |
| CVE-2018-1332 | MED 6.5 | apache storm Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons. | 1.5% | — |
| CVE-2016-7384 | HIGH 7.8 | nvidia gpu_driver For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) where unchecked input/output lengths in UVMLiteController Device IO C | 1.5% | — |
| CVE-2023-29246 | HIGH 7.2 | apache openmeetings An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 | 1.5% | — |
| CVE-2023-26513 | HIGH 7.5 | apache sling_resource_merger Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2. | 1.5% | — |
| CVE-2023-21556 | HIGH 8.1 | microsoft windows_10_1607 Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2020-16990 | MED 6.2 | microsoft azure_sphere Azure Sphere Information Disclosure Vulnerability | 1.5% | — |
| CVE-2013-1100 | MED 5.4 | cisco ios The HTTP server in Cisco IOS on Catalyst switches does not properly handle TCP socket events, which allows remote attackers to cause a denial of service (device crash) via crafted packets on TCP port (1) 80 or (2) 443, aka Bug ID CSCuc53853. | 1.5% | — |
| CVE-2006-6573 | MED 6.0 | citrix access_gateway Unspecified vulnerability in Citrix Access Gateway 4.5 Advanced Edition, and 4.2 with Advanced Access Control (AAC) 4.2, when deployed on the Access Gateway appliance 4.2 through 4.2.2 allows remote authenticated users to "gain access to data" and obtain sensi | 1.5% | — |
| CVE-2024-21401 | CRIT 9.8 | microsoft entra_jira_sso_plugin Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability | 1.5% | — |
| CVE-2023-38184 | HIGH 7.5 | microsoft windows_10_1507 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2023-28275 | HIGH 8.8 | microsoft windows_10_1507 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2018-8651 | MED 5.4 | microsoft dynamics_nav A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynam | 1.5% | — |
| CVE-2018-4464 | HIGH 8.8 | apple icloud Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. | 1.5% | — |
| CVE-2018-4378 | HIGH 8.8 | apple icloud A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8. | 1.5% | — |
| CVE-2017-2671 | MED 5.5 | linux linux_kernel The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leve | 1.5% | — |
| CVE-2015-2023 | HIGH 8.8 | ibm i_access Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors. | 1.5% | — |
| CVE-2023-21703 | MED 6.5 | microsoft azure_data_box_gateway Azure Data Box Gateway Remote Code Execution Vulnerability | 1.5% | — |