57.613 CVE tracked
783 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.613 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-3245 | MED 5.3 | cisco smart_software_manager_on-prem A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web applicatio | 1.2% | — |
| CVE-2018-6976 | MED 5.3 | vmware workspace_one The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted filenames and associated metadata in SQLite database for the Content Locker. | 1.2% | — |
| CVE-2016-9151 | HIGH 7.8 | paloaltonetworks pan-os Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows local users to gain privileges via crafted values of unspecified environment variables. | 1.2% | — |
| CVE-2014-3284 | MED 6.1 | cisco asr_1001 Cisco IOS XE on ASR1000 devices, when PPPoE termination is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed PPPoE packet, aka Bug ID CSCuo55180. | 1.2% | — |
| CVE-2009-1412 | HIGH 7.8 | google chrome Argument injection vulnerability in the chromehtml: protocol handler in Google Chrome before 1.0.154.59, when invoked by Internet Explorer, allows remote attackers to determine the existence of files, and open tabs for URLs that do not satisfy the IsWebSafeSch | 1.2% | — |
| CVE-2024-49076 | HIGH 7.8 | microsoft windows_10_1809 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | 1.2% | — |
| CVE-2023-22268 | MED 6.5 | adobe robohelp_server Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to information disclosure by an low-privileged authenticated attacker. Exploit | 1.2% | — |
| CVE-2023-21685 | HIGH 8.8 | microsoft windows_10_1507 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 1.2% | — |
| CVE-2022-22241 | HIGH 8.1 | juniper junos An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to un | 1.2% | — |
| CVE-2021-4154 | HIGH 8.8 | linux linux_kernel A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a cont | 1.2% | — |
| CVE-2020-4783 | MED 5.9 | ibm spectrum_protect_plus IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information | 1.2% | — |
| CVE-2019-1975 | MED 6.1 | cisco hyperflex_hx220c_af_m5_firmware A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An a | 1.2% | — |
| CVE-2019-1830 | MED 4.9 | cisco wireless_lan_controller_software A vulnerability in Locally Significant Certificate (LSC) management for the Cisco Wireless LAN Controller (WLC) could allow an authenticated, remote attacker to cause the device to unexpectedly restart, which causes a denial of service (DoS) condition. The att | 1.2% | — |
| CVE-2014-1899 | MED 4.3 | citrix netscaler_access_gateway Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 1.2% | — |
| CVE-2025-49630 | HIGH 7.5 | apache http_server In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured f | 1.2% | — |
| CVE-2023-24890 | MED 6.5 | microsoft onedrive Microsoft OneDrive for iOS Security Feature Bypass Vulnerability | 1.2% | — |
| CVE-2020-3927 | HIGH 8.3 | changingtec servisign An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter. | 1.2% | — |
| CVE-2020-15988 | MED 6.3 | debian debian_linux Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page. | 1.2% | — |
| CVE-2020-1207 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1247, CVE-2020-1251, CVE-2020-1253, | 1.2% | — |
| CVE-2016-1014 | HIGH 7.3 | adobe air_desktop_runtime Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directo | 1.2% | — |
| CVE-2015-7358 | HIGH 7.8 | ciphershed ciphershed The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an exist | 1.2% | — |
| CVE-2014-3322 | MED 6.1 | cisco asr_9000_rsp440_router Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which allows remote attackers to cause a denial of service (chip and card hangs) via malformed (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCuo68417. | 1.2% | — |
| CVE-2013-0880 | HIGH 7.5 | google chrome Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to databases. | 1.2% | — |
| CVE-2011-3318 | HIGH 7.8 | cisco video_surveillance_2421 Cisco Video Surveillance 2421 and 2500 series cameras with software 1.1.x and 2.x before 2.4.0 and Video Surveillance 2600 series cameras with software before 4.2.0-13 allow remote attackers to cause a denial of service (device reload) by sending crafted RTSP | 1.2% | — |
| CVE-2011-3287 | HIGH 7.8 | cisco jabber_extensible_communications_platform Cisco Jabber Extensible Communications Platform (aka Jabber XCP) 2.x through 5.4.x before 5.4.0.27581 and 5.8.x before 5.8.1.27561 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory an | 1.2% | — |