57.479 CVE tracked
782 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.479 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-2018 | CRIT 9.0 | paloaltonetworks pan-os An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged access to managed firewalls. An attacker requires some knowledge of managed firewall | 1.3% | — |
| CVE-2017-5114 | HIGH 8.8 | debian debian_linux Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac, and 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file. | 1.3% | — |
| CVE-2017-14687 | HIGH 7.8 | artifex mupdf Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" on Windows. This occurs b | 1.3% | — |
| CVE-2017-14685 | HIGH 7.8 | artifex mupdf Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs b | 1.3% | — |
| CVE-2016-8466 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged proc | 1.3% | — |
| CVE-2016-8454 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. | 1.3% | — |
| CVE-2016-8450 | HIGH 7.0 | linux linux_kernel An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. | 1.3% | — |
| CVE-2012-6597 | MED 6.3 | paloaltonetworks pan-os Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to cause a denial of service (management-server crash) by using the command-line interface for a crafted command, aka Ref ID 35254. | 1.3% | — |
| CVE-2012-5014 | MED 6.3 | cisco ios Cisco IOS before 15.1(2)SY allows remote authenticated users to cause a denial of service (device crash) by establishing an SSH session from a client and then placing this client into a (1) slow or (2) idle state, aka Bug ID CSCto87436. | 1.3% | — |
| CVE-2010-4039 | CRIT 9.8 | google chrome Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors. | 1.3% | — |
| CVE-2009-1555 | MED 5.0 | cisco wvc54gca The Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 sends configuration data in response to a Setup Wizard remote-management command, which allows remote attackers to obtain sensitive information such as passwords by reading the | 1.3% | — |
| CVE-2006-6579 | MED 4.4 | microsoft internet_information_server Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder, as demonstrated by an ASP shell that has write access by IWAM_ | 1.3% | — |
| CVE-2024-38131 | HIGH 8.8 | microsoft remote_desktop_client Clipboard Virtual Channel Extension Remote Code Execution Vulnerability | 1.3% | — |
| CVE-2021-28461 | MED 6.1 | microsoft dynamics_365 Dynamics Finance and Operations Cross-site Scripting Vulnerability | 1.3% | — |
| CVE-2021-1471 | CRIT 9.9 | cisco jabber Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, | 1.3% | — |
| CVE-2020-1424 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of Privilege Vulnerability'. | 1.3% | — |
| CVE-2020-1007 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0821. | 1.3% | — |
| CVE-2019-1391 | MED 5.5 | microsoft windows_10 A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID is unique from CVE-2018-12207. | 1.3% | — |
| CVE-2013-1170 | HIGH 7.5 | cisco prime_network_control_system The Cisco Prime Network Control System (NCS) appliance with software before 1.1.1.24 has a default password for the database user account, which makes it easier for remote attackers to change the configuration or cause a denial of service (service disruption) | 1.3% | — |
| CVE-2010-1893 | MED 6.8 | microsoft windows_7 Integer overflow in the TCP/IP stack in Microsoft Windows Vista SP1, Windows Server 2008 Gold and R2, and Windows 7 allows local users to gain privileges via a buffer of user-mode data that is copied to kernel mode, aka "Integer Overflow in Windows Networking | 1.3% | — |
| CVE-2007-1537 | LOW 3.6 | microsoft windows_2003_server \Device\NdisTapi (NDISTAPI.sys) in Microsoft Windows XP SP2 and 2003 SP1 uses weak permissions, which allows local users to write to the device and cause a denial of service, as demonstrated by using an IRQL to acquire a spinlock on paged memory via the NdisTa | 1.3% | — |
| CVE-2023-23777 | HIGH 7.2 | fortinet fortiweb An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash comma | 1.3% | — |
| CVE-2020-5019 | MED 6.5 | ibm spectrum_protect_plus IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP H | 1.3% | — |
| CVE-2019-9510 | MED 5.3 | microsoft windows_10 A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user sessions without needing to interact with the Windows lock screen. Should a network anomaly trigger a te | 1.3% | — |
| CVE-2019-6628 | HIGH 7.5 | f5 big-ip_policy_enforcement_manager On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-IP PEM traffic with the OpenVPN classifier. | 1.3% | — |