58.151 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.151 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-5643 | HIGH 7.4 | apache camel Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. | 5.9% | — |
| CVE-2017-3849 | HIGH 7.4 | cisco ios A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software (possibly 15.2 through 15.6) and Cisco IOS XE Software (possibly 3.7 through 3.18, and 16) could allow an unauthenticated, adjacent attacker to cause a den | 0.8% | — |
| CVE-2017-3160 | HIGH 7.4 | apache cordova After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle | 3.8% | — |
| CVE-2017-3085 | HIGH 7.4 | adobe flash_player Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect. | 4.5% | — |
| CVE-2017-1677 | HIGH 7.4 | ibm db2 IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-F | 0.7% | — |
| CVE-2017-12275 | HIGH 7.4 | cisco wireless_lan_controller_software A vulnerability in the implementation of 802.11v Basic Service Set (BSS) Transition Management functionality in Cisco Wireless LAN Controllers could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a | 0.7% | — |
| CVE-2017-10620 | HIGH 7.4 | juniper junos Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures to cause service disruptions or make the device not detect | 0.6% | — |
| CVE-2017-1000407 | HIGH 7.4 | canonical ubuntu_linux The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic. | 1.2% | — |
| CVE-2017-1000364 | HIGH 7.4 | linux linux_kernel An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguar | 5.2% | — |
| CVE-2016-8495 | HIGH 7.4 | fortinet fortimanager_firmware An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack via the Fortisandbox devices probing feature. | 0.9% | — |
| CVE-2016-6516 | HIGH 7.4 | linux linux_kernel Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch | 0.9% | — |
| CVE-2016-3699 | HIGH 7.4 | linux linux_kernel The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the init | 0.5% | — |
| CVE-2016-3378 | HIGH 7.4 | microsoft exchange_server Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishin | 15.3% | — |
| CVE-2016-2084 | HIGH 7.4 | f5 big-ip_access_policy_manager F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256, 11.6.0 before build 6.204.442, and 12.0.0 before build 1.14.628; BIG-IP AAM 11.4. | 0.8% | — |
| CVE-2016-2069 | HIGH 7.4 | canonical ubuntu_linux Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU. | 0.3% | — |
| CVE-2016-1392 | HIGH 7.4 | cisco prime_collaboration_assurance Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuu34121. | 1.0% | — |
| CVE-2016-1389 | HIGH 7.4 | cisco webex_meetings_server Open redirect vulnerability in Cisco WebEx Meetings Server (CWMS) 2.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuy44695. | 1.3% | — |
| CVE-2015-7393 | HIGH 7.4 | f5 big-ip_access_policy_manager dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AFM and PEM 11.3.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP DNS 1 | 0.3% | — |
| CVE-2014-0049 | HIGH 7.4 | linux linux_kernel Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_wor | 0.8% | — |
| CVE-2013-1292 | HIGH 7.4 | microsoft windows_7 Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted applicat | 0.9% | — |
| CVE-2013-1278 | HIGH 7.4 | microsoft windows_7 Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges | 0.9% | — |
| CVE-2012-1326 | HIGH 7.4 | cisco ironport_web_security_appliance Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks | 0.7% | — |
| CVE-2011-1898 | HIGH 7.4 | citrix xen Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection r | 0.9% | — |
| CVE-2011-0029 | HIGH 7.4 | microsoft remote_desktop_connection_client Untrusted search path vulnerability in the client in Microsoft Remote Desktop Connection 5.2, 6.0, 6.1, and 7.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp f | 7.2% | — |
| CVE-2010-2245 | HIGH 7.4 | apache wink XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a crafted XML document. | 11.6% | — |