56.704 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.704 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-20118 | MED 4.4 | cisco application_policy_infrastructure_controller A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative | 0.2% | — |
| CVE-2025-13635 | MED 4.4 | google chrome Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 0.1% | — |
| CVE-2025-13634 | MED 4.4 | google chrome Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted HTML page. (Chromium security severity: Medium) | 0.2% | — |
| CVE-2025-11790 | MED 4.4 | acronis agent Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124. | 0.1% | — |
| CVE-2024-8690 | MED 4.4 | paloaltonetworks cortex_xdr_agent A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to per | 0.2% | — |
| CVE-2024-8688 | MED 4.4 | paloaltonetworks pan-os An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators (including read-only administrators) with access to the CLI to to read arbitrary files on the firewa | 0.2% | — |
| CVE-2024-7577 | MED 4.4 | ibm infosphere_information_server IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product. | 0.3% | — |
| CVE-2024-5916 | MED 4.4 | paloaltonetworks pan-os An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can rea | 0.2% | — |
| CVE-2024-5905 | MED 4.4 | paloaltonetworks cortex_xdr_agent A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some functionality of the agent. However, they are not able to disrupt Cortex XDR agent protection mechani | 0.1% | — |
| CVE-2024-53052 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happeni | 0.2% | — |
| CVE-2024-49338 | MED 4.4 | ibm app_connect_enterprise IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials. | 0.4% | — |
| CVE-2024-42230 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (reloc_on_exc), required for scv instruction support, before other CPUs have been shut down. This means th | 0.2% | — |
| CVE-2024-42154 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at a | 0.3% | — |
| CVE-2024-42131 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplication | 0.2% | — |
| CVE-2024-42114 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit | 0.2% | — |
| CVE-2024-40588 | MED 4.4 | fortinet forticamera_firmware Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versions, FortiCamera 1.0 all versions, FortiMail 7.6.0 through 7.6.1, FortiMail 7.4.0 through 7.4.3, Forti | 0.2% | — |
| CVE-2024-38559 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer b | 0.3% | — |
| CVE-2024-38550 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ASoC: kirkwood: Fix potential NULL dereference In kirkwood_dma_hw_params() mv_mbus_dram_info() returns NULL if CONFIG_PLAT_ORION macro is not defined. Fix this bug by adding NULL check. Fou | 0.2% | — |
| CVE-2024-38540 | MED 4.4 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_ | 0.2% | — |
| CVE-2024-38123 | MED 4.4 | microsoft windows_11_24h2 Windows Bluetooth Driver Information Disclosure Vulnerability | 0.7% | — |
| CVE-2024-36950 | MED 4.4 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset | 0.3% | — |
| CVE-2024-35253 | MED 4.4 | microsoft azure_file_sync Microsoft Azure File Sync Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2024-35117 | MED 4.4 | ibm openpages_with_watson IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtained by a privileged user. | 0.2% | — |
| CVE-2024-28775 | MED 4.4 | ibm websphere_automation IBM WebSphere Automation 1.7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessi | 0.4% | — |
| CVE-2024-28132 | MED 4.4 | f5 big-ip_next_cloud-native_network_functions Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evalua | 0.2% | — |