57.435 CVE tracked
782 Exploited now
187 Used by ransomware
Last sync
CVE Tracker
57.435 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-30194 | HIGH 7.5 | microsoft windows_10 Windows WebBrowser Control Remote Code Execution Vulnerability | 1.5% | — |
| CVE-2016-7292 | HIGH 7.8 | microsoft windows_10 The Installer in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 mishandles library loading, which allows loc | 1.5% | — |
| CVE-2016-1378 | MED 5.3 | cisco ios Cisco IOS before 15.2(2)E1 on Catalyst switches allows remote attackers to obtain potentially sensitive software-version information via a request to the Network Mobility Services Protocol (NMSP) port, aka Bug ID CSCum62591. | 1.5% | — |
| CVE-2016-1316 | MED 5.3 | cisco telepresence_video_communication_server_software Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7, as used in conjunction with Jabber Guest, allows remote attackers to obtain sensitive call-statistics information via a direct request to an unspecified URL, aka Bug ID CSCux73362. | 1.5% | — |
| CVE-2013-6944 | MED 4.3 | citrix netscaler_application_delivery_controller_firmware Cross-site scripting (XSS) vulnerability in the user interface in the AAA TM vServer in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to inject arbitrary | 1.5% | — |
| CVE-2002-1447 | HIGH 7.2 | cisco vpn_client Buffer overflow in the vpnclient program for UNIX VPN Client before 3.5.2 allows local users to gain administrative privileges via a long profile name in a connect argument. | 1.5% | — |
| CVE-2023-28754 | HIGH 8.8 | apache shardingsphere Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file. The attacker needs to have permission to modify the ShardingSphere Agent YAML c | 1.5% | — |
| CVE-2023-22274 | HIGH 7.5 | adobe robohelp_server Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this issue does not require | 1.5% | — |
| CVE-2019-6609 | CRIT 9.8 | f5 big-ip_access_policy_manager Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 | 1.5% | — |
| CVE-2015-8950 | MED 5.5 | linux linux_kernel arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a d | 1.5% | — |
| CVE-2012-6324 | MED 4.0 | vmware vcenter_server_appliance Directory traversal vulnerability in VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 and 5.1 before Patch 1 allows remote authenticated users to read arbitrary files via unspecified vectors. | 1.5% | — |
| CVE-2026-8398 | CRIT 9.8 | disc-soft daemon_tools A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attacker | 1.5% | |
| CVE-2024-5921 | HIGH 8.8 | paloaltonetworks globalprotect An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subn | 1.5% | — |
| CVE-2020-1289 | MED 5.4 | microsoft sharepoint_foundation A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-1148. | 1.5% | — |
| CVE-2018-4392 | HIGH 8.8 | apple icloud Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8. | 1.5% | — |
| CVE-2018-1095 | MED 5.5 | linux linux_kernel The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_ | 1.5% | — |
| CVE-2017-6708 | CRIT 9.8 | cisco ultra_services_framework A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulner | 1.5% | — |
| CVE-2015-6256 | MED 5.0 | cisco asr_5000_series_software Cisco ASR 5000 devices with software 19.0.M0.60828 allow remote attackers to cause a denial of service (OSPF process restart) via crafted length fields in headers of OSPF packets, aka Bug ID CSCuv62820. | 1.5% | — |
| CVE-2015-0776 | MED 5.0 | cisco ios_xr telnetd in Cisco IOS XR 5.0.1 on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (device reload) via a malformed TELNET packet, aka Bug ID CSCuq31566. | 1.5% | — |
| CVE-2013-1241 | MED 6.3 | cisco 1921_integrated_services_router The ISM module in Cisco IOS on ISR G2 routers does not properly handle authentication-header packets, which allows remote authenticated users to cause a denial of service (module reload) via a series of malformed packets, aka Bug ID CSCub92025. | 1.5% | — |
| CVE-2010-1572 | HIGH 9.0 | cisco application_extension_framework Unspecified vulnerability in the tech support diagnostic shell in Cisco Application Extension Platform (AXP) 1.1 and 1.1.5 allows local users to obtain sensitive configuration information and gain administrator privileges via unspecified API calls. | 1.5% | — |
| CVE-2002-1749 | HIGH 7.2 | microsoft windows_2000 Windows 2000 Terminal Services, when using the disconnect feature of the client, does not properly lock itself if it is left idle until the screen saver activates and the user disconnects, which could allow attackers to gain administrator privileges. | 1.5% | — |
| CVE-2023-33143 | HIGH 7.5 | microsoft edge_chromium Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 1.5% | — |
| CVE-2022-22040 | HIGH 7.3 | microsoft windows_10 Internet Information Services Dynamic Compression Module Denial of Service Vulnerability | 1.5% | — |
| CVE-2022-20756 | HIGH 8.6 | cisco identity_services_engine A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of certain RADIUS reque | 1.5% | — |