56.721 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.721 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-34715 | MED 4.7 | cisco expressway A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system | 1.1% | — |
| CVE-2021-34425 | MED 4.7 | zoom meetings The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "l | 0.8% | — |
| CVE-2021-33753 | MED 4.7 | microsoft bing Microsoft Bing Search Spoofing Vulnerability | 1.9% | — |
| CVE-2021-33624 | MED 4.7 | debian debian_linux In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db. | 0.9% | — |
| CVE-2021-32786 | MED 4.7 | fedoraproject fedora mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` doe | 2.4% | — |
| CVE-2021-29265 | MED 4.7 | debian debian_linux An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, | 0.3% | — |
| CVE-2021-28964 | MED 4.7 | debian debian_linux A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc. | 0.3% | — |
| CVE-2021-27853 | MED 4.7 | cisco catalyst_6503-e_firmware Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers. | 0.7% | — |
| CVE-2021-26092 | MED 4.7 | fortinet fortios Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow | 1.1% | — |
| CVE-2021-20321 | MED 4.7 | debian debian_linux A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system. | 0.2% | — |
| CVE-2021-1616 | MED 4.7 | cisco ios_xe A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass the ALG. This vulnerability is due to insufficient data valida | 1.2% | — |
| CVE-2021-1555 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1554 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.6% | — |
| CVE-2021-1553 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1552 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1551 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1550 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1549 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.7% | — |
| CVE-2021-1548 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.6% | — |
| CVE-2021-1547 | MED 4.7 | cisco wap125_firmware Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These | 1.6% | — |
| CVE-2021-1538 | MED 4.7 | cisco common_services_platform_collector A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbitrary code. This vulnerability is due to insufficient sanitization of configuration entries. An attac | 1.8% | — |
| CVE-2021-1525 | MED 4.7 | cisco webex_meetings_online A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attack | 0.8% | — |
| CVE-2021-1519 | MED 4.7 | cisco anyconnect_secure_mobility_client A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validatio | 0.2% | — |
| CVE-2021-1490 | MED 4.7 | cisco web_security_appliance A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. | 0.7% | — |
| CVE-2021-1420 | MED 4.7 | cisco webex_meetings A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's browser. The vulnerability is due to improper checks on parameter values in affected pages. An attacker | 0.9% | — |