60.383 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.383 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-49804 | MED 6.6 | microsoft windows_10_1607 Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack. | 0.5% | — |
| CVE-2026-23889 | MED 6.5 | pnpm pnpm pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Win | 0.5% | — |
| CVE-2025-55753 | HIGH 7.5 | apache http_server An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. T | 0.5% | — |
| CVE-2025-52961 | MED 6.5 | juniper junos_os_evolved An Uncontrolled Resource Consumption vulnerability in the Connectivity Fault Management (CFM) daemon and the Connectivity Fault Management Manager (cfmman) of Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, PTX10016 all | 0.5% | — |
| CVE-2025-26648 | HIGH 7.8 | microsoft windows_10_1507 Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-21338 | HIGH 7.8 | microsoft office GDI+ Remote Code Execution Vulnerability | 0.5% | — |
| CVE-2024-54169 | MED 6.5 | ibm entirex IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | 0.5% | — |
| CVE-2024-41879 | HIGH 7.8 | adobe acrobat_reader Acrobat Reader versions 127.0.2651.105 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must | 0.5% | — |
| CVE-2024-28923 | MED 6.4 | microsoft windows_10_1507 Secure Boot Security Feature Bypass Vulnerability | 0.5% | — |
| CVE-2024-2551 | HIGH 7.5 | paloaltonetworks pan-os A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. | 0.5% | — |
| CVE-2023-20188 | MED 4.8 | cisco sf200-24_firmware A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authenticated, remote attac | 0.5% | — |
| CVE-2022-49452 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: retrieve the virtual address before dma_unmap The TSO header was DMA unmapped before the virtual address was retrieved and then used to free the buffer. This meant that we were ac | 0.5% | — |
| CVE-2022-27880 | MED 4.8 | f5 traffix_signaling_delivery_controller On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the co | 0.5% | — |
| CVE-2022-27662 | MED 4.8 | f5 traffix_signaling_delivery_controller On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language | 0.5% | — |
| CVE-2021-47496 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tls_err_abort() calls sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other co | 0.5% | — |
| CVE-2021-47132 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sk_forward_memory corruption on retransmission MPTCP sk_forward_memory handling is a bit special, as such field is protected by the msk socket spin_lock, instead of the plain sock | 0.5% | — |
| CVE-2020-11668 | HIGH 7.1 | linux linux_kernel In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770. | 0.5% | — |
| CVE-2019-6687 | HIGH 7.4 | f5 big-ip_application_security_manager On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly authenticate the X.509 certificate of remote endpoints. | 0.5% | — |
| CVE-2017-12301 | MED 6.7 | cisco nx-os A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and gain unauthorized access to the underlying operating system of the device. The vulnerability exists due to in | 0.5% | — |
| CVE-2016-4565 | HIGH 7.8 | canonical ubuntu_linux The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. | 0.5% | — |
| CVE-2015-4224 | HIGH 7.2 | cisco wireless_lan_controller_software Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged context via crafted CLI commands, aka Bug ID CSCuj39474. | 0.5% | — |
| CVE-2015-4106 | MED 4.6 | canonical ubuntu_linux QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other u | 0.5% | — |
| CVE-2011-4917 | MED 5.5 | linux linux_kernel In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat. | 0.5% | — |
| CVE-2011-2495 | LOW 2.1 | linux linux_kernel fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password. | 0.5% | — |
| CVE-2010-2962 | HIGH 7.2 | canonical ubuntu_linux drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users | 0.5% | — |