57.479 CVE tracked
782 Exploited now
187 Used by ransomware
Last sync
CVE Tracker
57.479 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-53338 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redire | 0.5% | — |
| CVE-2018-1922 | HIGH 8.4 | ibm db2 IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152858. | 0.5% | — |
| CVE-2006-6056 | MED 4.9 | linux linux_kernel Linux kernel 2.6.x up to 2.6.18 and possibly other versions, when SELinux hooks are enabled, allows local users to cause a denial of service (crash) via a malformed file stream that triggers a NULL pointer dereference in the superblock_doinit function, as demo | 0.5% | — |
| CVE-2026-69558 | HIGH 8.6 | microsoft partner_center Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network. | 0.5% | — |
| CVE-2026-66800 | HIGH 8.6 | microsoft azure_data_factory Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network. | 0.5% | — |
| CVE-2026-5272 | HIGH 8.8 | google chrome Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | 0.5% | — |
| CVE-2025-49664 | MED 5.5 | microsoft windows_10_1507 Exposure of sensitive information to an unauthorized actor in Windows User-Mode Driver Framework Host allows an authorized attacker to disclose information locally. | 0.5% | — |
| CVE-2025-21271 | HIGH 7.8 | microsoft windows_10_1809 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2024-56688 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the xs_ | 0.5% | — |
| CVE-2024-46855 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning. | 0.5% | — |
| CVE-2024-30099 | HIGH 7.0 | microsoft windows_10_1507 Windows Kernel Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2024-21336 | LOW 2.5 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0.5% | — |
| CVE-2023-35898 | MED 4.3 | ibm infosphere_information_server IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSphere Data Flow Designer. IBM X-Force ID: 259352. | 0.5% | — |
| CVE-2022-31676 | HIGH 7.8 | debian debian_linux VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. | 0.5% | — |
| CVE-2022-30991 | MED 6.1 | acronis cyber_protect HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 | 0.5% | — |
| CVE-2021-47136 | HIGH 8.6 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of t | 0.5% | — |
| CVE-2019-1605 | HIGH 7.8 | cisco nx-os A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability is due to incorrect input validation in the NX-API feature. An attacker could exploit this vulnerabi | 0.5% | — |
| CVE-2018-10940 | MED 5.5 | debian debian_linux The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory. | 0.5% | — |
| CVE-2015-4330 | MED 6.9 | cisco telepresence_video_communication_server_software A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556. | 0.5% | — |
| CVE-2010-4157 | MED 6.2 | fedoraproject fedora Integer overflow in the ioc_general function in drivers/scsi/gdth.c in the Linux kernel before 2.6.36.1 on 64-bit platforms allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large argument in an | 0.5% | — |
| CVE-2026-78506 | MED 5.5 | microsoft 365_apps Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-73240 | CRIT 9.8 | apache allura Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. | 0.5% | — |
| CVE-2026-68782 | CRIT 9.9 | microsoft azure_sql_database Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-58297 | HIGH 7.1 | microsoft edge_chromium Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. | 0.5% | — |
| CVE-2026-58296 | HIGH 7.1 | microsoft edge_chromium Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. | 0.5% | — |