56.672 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.672 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-6644 | CRIT 9.4 | f5 big-ip_access_policy_manager Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the p | 1.4% | — |
| CVE-2018-15441 | CRIT 9.4 | cisco prime_license_manager A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An a | 3.7% | — |
| CVE-2015-6259 | HIGH 9.4 | cisco integrated_management_controller_supervisor The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted | 2.8% | — |
| CVE-2013-3658 | HIGH 9.4 | vmware esx Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors. | 3.7% | — |
| CVE-2008-5518 | HIGH 9.4 | apache geronimo Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group | 35.9% | — |
| CVE-2008-1454 | HIGH 9.4 | microsoft windows_2000 Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vectors related to accepting "records from a response that is outside the remote ser | 34.1% | — |
| CVE-2006-6535 | HIGH 9.4 | linux linux_kernel The dev_queue_xmit function in Linux kernel 2.6 can fail before calling the local_bh_disable function, which could lead to data corruption and "node lockups." NOTE: it is not clear whether this issue is exploitable. | 2.6% | — |
| CVE-2005-4332 | HIGH 9.4 | cisco network_admission_control_manager_and_server_system_software Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including (1) admin/uploadclient.jsp, (2) apply_firmware_a | 3.8% | — |
| CVE-2026-70306 | CRIT 9.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 0.7% | — |
| CVE-2026-62835 | CRIT 9.3 | microsoft azure_portal Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. | 1.0% | — |
| CVE-2026-62834 | CRIT 9.3 | microsoft azure_data_factory Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network. | 0.3% | — |
| CVE-2026-59118 | CRIT 9.3 | microsoft power_apps Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network. | 0.4% | — |
| CVE-2026-58155 | CRIT 9.3 | apache traffic_server Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recom | 0.4% | — |
| CVE-2026-49871 | CRIT 9.3 | apache apisix Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a | 0.3% | — |
| CVE-2026-49798 | CRIT 9.3 | microsoft windows_10_1607 Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. | 2.3% | — |
| CVE-2026-48334 | CRIT 9.3 | adobe illustrator Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this is | 0.4% | — |
| CVE-2026-47646 | CRIT 9.3 | microsoft dynamics_365_customer_voice Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network. | 0.3% | — |
| CVE-2026-46316 | CRIT 9.3 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's | 0.4% | — |
| CVE-2026-41920 | CRIT 9.3 | apache traffic_server Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue. | 0.3% | — |
| CVE-2026-41106 | CRIT 9.3 | microsoft 365_copilot Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. | 0.5% | — |
| CVE-2026-41090 | CRIT 9.3 | microsoft 365_copilot Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. | 0.4% | — |
| CVE-2026-40402 | CRIT 9.3 | microsoft windows_11_23h2 Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. | 0.3% | — |
| CVE-2026-40379 | CRIT 9.3 | microsoft entra_id Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. | 0.9% | — |
| CVE-2026-34691 | CRIT 9.3 | adobe experience_manager Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be | 0.4% | — |
| CVE-2026-34615 | CRIT 9.3 | adobe connect Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject maliciou | 0.6% | — |