58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.507 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2006-4138 | HIGH 7.6 | microsoft help_file_viewer Multiple unspecified vulnerabilities in Microsoft Windows Help File viewer (winhlp32.exe) allow user-assisted attackers to execute arbitrary code via crafted HLP files. | 20.1% | — |
| CVE-2006-3747 | HIGH 7.6 | apache http_server Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash | 96.6% | — |
| CVE-2006-3660 | HIGH 7.6 | microsoft powerpoint Unspecified vulnerability in Microsoft PowerPoint 2003 has unknown impact and user-assisted attack vectors related to powerpnt.exe. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3656, an | 18.2% | — |
| CVE-2006-3648 | HIGH 7.6 | microsoft windows_2000 Unspecified vulnerability in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 and 2003 SP1, allows remote attackers to execute arbitrary code via unspecified vectors involving unhandled exceptions, memory resident applications, and incorrectly "unloadin | 23.6% | — |
| CVE-2006-3442 | HIGH 7.6 | microsoft windows_xp Unspecified vulnerability in Pragmatic General Multicast (PGM) in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message. | 27.1% | — |
| CVE-2006-2385 | HIGH 7.6 | microsoft ie Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file. | 20.1% | — |
| CVE-2006-0022 | HIGH 7.6 | microsoft powerpoint Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed re | 14.5% | — |
| CVE-2005-3618 | HIGH 7.6 | vmware esx Cross-site request forgery (CSRF) vulnerability in the management interface for VMware ESX Server 2.0.x before 2.0.2 patch 1, 2.1.x before 2.1.3 patch 1, and 2.x before 2.5.3 patch 2 allows allows remote attackers to perform unauthorized actions as the adminis | 3.1% | — |
| CVE-2005-2124 | HIGH 7.6 | microsoft windows_2000 Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to "An unchecked buffer" and possibly buffer overflows, allows remote attackers to execute arbitrary code via a crafted Win | 55.7% | — |
| CVE-2003-0906 | HIGH 7.6 | microsoft windows_2000 Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image. | 25.2% | — |
| CVE-2002-0070 | HIGH 7.6 | microsoft windows_2000 Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a custom URL handler that has not been removed for an application that has been improperly uninstalled. | 18.5% | — |
| CVE-2000-0464 | HIGH 7.6 | microsoft internet_explorer Internet Explorer 4.x and 5.x allows remote attackers to execute arbitrary commands via a buffer overflow in the ActiveX parameter parsing capability, aka the "Malformed Component Attribute" vulnerability. | 13.3% | — |
| CVE-2000-0330 | HIGH 7.6 | microsoft windows_95 The networking software in Windows 95 and Windows 98 allows remote attackers to execute commands via a long file name string, aka the "File Access URL" vulnerability. | 15.0% | — |
| CVE-2000-0327 | HIGH 7.6 | microsoft virtual_machine Microsoft Virtual Machine (VM) allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, aka the "Virtual Machine Verifier" vulnerability. | 11.8% | — |
| CVE-2000-0323 | HIGH 7.6 | microsoft jet The Microsoft Jet database engine allows an attacker to modify text files via a database query, aka the "Text I-ISAM" vulnerability. | 5.5% | — |
| CVE-2000-0160 | HIGH 7.6 | microsoft ie The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft. | 9.2% | — |
| CVE-1999-1593 | HIGH 7.6 | microsoft windows_2000 Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1Ch registration that causes WINS to change the domain controller to point to a malicious server. NOTE: this problem may | 18.1% | — |
| CVE-1999-0802 | HIGH 7.6 | microsoft internet_explorer Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed Favorites icon. | 10.2% | — |
| CVE-2026-8856 | HIGH 7.7 | ibm http_server IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration. | 0.3% | — |
| CVE-2026-8666 | HIGH 7.7 | rapid7 insightconnect_traceroute OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient inpu | 1.2% | — |
| CVE-2026-8665 | HIGH 7.7 | rapid7 insightconnect_translate OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command constr | 1.2% | — |
| CVE-2026-8660 | HIGH 7.7 | rapid7 insightconnect_ping OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands. | 1.2% | — |
| CVE-2026-8592 | HIGH 7.7 | rapid7 insightconnect_awk OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processi | 1.2% | — |
| CVE-2026-85887 | HIGH 7.7 | microsoft 365_copilot Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network. | 0.8% | — |
| CVE-2026-77909 | HIGH 7.7 | microsoft azure_cyclecloud Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network. | 0.9% | — |