60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2018-0433 | HIGH 7.8 | cisco vbond_orchestrator A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An att | 0.4% | — |
| CVE-2017-5549 | MED 5.5 | linux linux_kernel The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information | 0.4% | — |
| CVE-2016-1278 | HIGH 7.8 | juniper junos Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a password after a failed upgrade to 12.1X46, which might allow local users to gain privileges by leveraging use of the "request | 0.4% | — |
| CVE-2014-0206 | LOW 2.1 | linux linux_kernel Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value. | 0.4% | — |
| CVE-2012-2764 | HIGH 7.2 | google chrome Untrusted search path vulnerability in Google Chrome before 20.0.1132.43 on Windows might allow local users to gain privileges via a Trojan horse Metro DLL in the current working directory. | 0.4% | — |
| CVE-2026-73635 | HIGH 7.5 | apache struts Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the frame | 0.5% | — |
| CVE-2026-46729 | HIGH 7.5 | apache http_server NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | 0.5% | — |
| CVE-2026-43254 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - fix packet extraction from stream When processing TCP stream data in ovpn_tcp_recv, we receive large cloned skbs from __strp_rcv that may contain multiple coalesced packets. The | 0.5% | — |
| CVE-2026-43164 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb(). syzbot reported null-ptr-deref of udp_sk(sk)->udp_prod_queue. [0] Since the cited commit, udp_lib_init_sock() can fail, as can u | 0.5% | — |
| CVE-2026-41636 | HIGH 7.5 | apache thrift Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. | 0.5% | — |
| CVE-2026-31557 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: nvmet: move async event work off nvmet-wq For target nvmet_ctrl_free() flushes ctrl->async_event_work. If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue completion for the | 0.5% | — |
| CVE-2026-21508 | HIGH 7.0 | microsoft windows_10_1607 Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2026-100208 | HIGH 7.5 | microsoft 365_apps Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 0.5% | — |
| CVE-2025-43577 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i | 0.5% | — |
| CVE-2025-43550 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i | 0.5% | — |
| CVE-2025-33067 | HIGH 8.4 | microsoft windows_10_1507 Improper privilege management in Windows Kernel allows an unauthorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-32726 | MED 6.8 | microsoft visual_studio_code Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-30416 | CRIT 10.0 | acronis cyber_protect Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800. | 0.5% | — |
| CVE-2025-11933 | MED 6.5 | wolfssl wolfssl Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions. | 0.5% | — |
| CVE-2024-49509 | HIGH 7.8 | adobe indesign InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v | 0.5% | — |
| CVE-2024-20340 | MED 6.5 | cisco secure_firewall_management_center A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to perform an SQL injection attack against an affected | 0.5% | — |
| CVE-2024-20316 | MED 5.8 | cisco ios_xe A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been protected by a configured IPv4 access control list (ACL). This vulnerability is due | 0.5% | — |
| CVE-2023-41613 | HIGH 7.8 | ezviz ezviz_studio EzViz Studio v2.2.0 is vulnerable to DLL hijacking. | 0.5% | — |
| CVE-2023-38364 | MED 6.1 | ibm cics_tx IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 0.5% | — |
| CVE-2023-28251 | MED 5.5 | microsoft windows_10_1507 Windows Driver Revocation List Security Feature Bypass Vulnerability | 0.5% | — |