56.580 CVE tracked
773 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.580 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-21388 | MED 6.5 | microsoft edge_chromium Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 32.0% | — |
| CVE-2008-3007 | HIGH 9.3 | microsoft office Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Re | 31.9% | — |
| CVE-2008-3005 | HIGH 9.3 | microsoft office Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted array index for a FORMAT record, aka the "Excel Index Array Vulnerabi | 31.9% | — |
| CVE-2008-1088 | HIGH 9.3 | microsoft project Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory resource allocations." | 31.9% | — |
| CVE-2008-0110 | HIGH 9.3 | microsoft office Unspecified vulnerability in Microsoft Outlook in Office 2000 SP3, XP SP3, 2003 SP2 and Sp3, and Office System allows user-assisted remote attackers to execute arbitrary code via a crafted mailto URI. | 31.9% | — |
| CVE-2010-3328 | HIGH 8.8 | microsoft internet_explorer Use-after-free vulnerability in the CAttrArray::PrivateFind function in mshtml.dll in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code by setting an unspecified property of a stylesheet object, aka "Uninitialized Memory | 31.9% | — |
| CVE-2008-1085 | HIGH 9.3 | microsoft ie Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 through SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream that triggers memory corruption, as demonstrated using an invalid MIME-type that does not hav | 31.9% | — |
| CVE-2008-0120 | HIGH 9.3 | microsoft office_powerpoint_viewer Integer overflow in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with a malformed picture index that triggers memory corruption, related to handling of CString objects, aka "Memory Allocation Vulnerab | 31.9% | — |
| CVE-2004-0901 | HIGH 10.0 | microsoft windows_2000 Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font | 31.9% | — |
| CVE-2019-15752 | HIGH 7.8 | apache geode Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service use | 31.9% | |
| CVE-2017-0071 | HIGH 7.5 | microsoft edge A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in | 31.9% | — |
| CVE-2022-4135 | CRIT 9.6 | google chrome Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | 31.9% | |
| CVE-2010-0250 | HIGH 9.3 | microsoft windows_7 Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2, and in Quartz on Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista | 31.9% | — |
| CVE-2003-0659 | HIGH 7.2 | microsoft windows_2000 Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application. | 31.8% | — |
| CVE-2012-1525 | HIGH 10.0 | adobe acrobat Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. | 31.8% | — |
| CVE-2016-3211 | HIGH 8.8 | microsoft internet_explorer Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016 | 31.8% | — |
| CVE-2024-38148 | HIGH 7.5 | microsoft windows_11_21h2 Windows Secure Channel Denial of Service Vulnerability | 31.8% | — |
| CVE-2009-0084 | HIGH 9.3 | microsoft directx Use-after-free vulnerability in DirectShow in Microsoft DirectX 8.1 and 9.0 allows remote attackers to execute arbitrary code via an MJPEG file or video stream with a malformed Huffman table, which triggers an exception that frees heap memory that is later acc | 31.8% | — |
| CVE-2007-2219 | HIGH 9.3 | microsoft windows_2000 Unspecified vulnerability in the Win32 API on Microsoft Windows 2000, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via certain parameters to an unspecified function. | 31.8% | — |
| CVE-2022-24463 | MED 6.5 | microsoft exchange_server Microsoft Exchange Server Spoofing Vulnerability | 31.8% | — |
| CVE-2011-2005 | HIGH 7.8 | microsoft windows_server_2003 afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Dr | 31.8% | |
| CVE-2008-3473 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, | 31.7% | — |
| CVE-2017-0094 | HIGH 7.5 | microsoft edge A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in | 31.7% | — |
| CVE-2012-5613 | MED 6.0 | mariadb mariadb MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging t | 31.7% | — |
| CVE-2006-1305 | MED 4.3 | microsoft office Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery) via malformed e-mail header information, possibly related to (1) long subject lines or (2) large numbers | 31.7% | — |