56.742 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.742 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-8751 | MED 4.8 | apache ranger Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies. | 2.1% | — |
| CVE-2016-5696 | MED 4.8 | google android net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack. | 15.1% | — |
| CVE-2016-5395 | MED 4.8 | apache ranger Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies. | 2.1% | — |
| CVE-2016-5005 | MED 4.8 | apache archiva Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action. | 4.8% | — |
| CVE-2016-10932 | MED 4.8 | hyper hyper An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted. | 1.2% | — |
| CVE-2015-6295 | MED 4.8 | cisco nx-os Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K) devices allows remote attackers to cause a denial of service (CPU consumption or control-plane instability) or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, a | 0.8% | — |
| CVE-2014-3405 | MED 4.8 | cisco ios_xe Cisco IOS XE enables the IPv6 Routing Protocol for Low-Power and Lossy Networks (aka RPL) on both the Autonomic Control Plane (ACP) and external Autonomic Networking Infrastructure (ANI) interfaces, which allows remote attackers to conduct route-injection atta | 0.7% | — |
| CVE-2014-3295 | MED 4.8 | cisco nx-os The HSRP implementation in Cisco NX-OS 6.2(2a) and earlier allows remote attackers to bypass authentication and cause a denial of service (group-member state modification and traffic blackholing) via malformed HSRP packets, aka Bug ID CSCup11309. | 1.1% | — |
| CVE-2014-3290 | MED 4.8 | cisco ios_xe The mDNS implementation in Cisco IOS XE 3.12S does not properly interact with autonomic networking, which allows remote attackers to obtain sensitive networking-services information by sniffing the network or overwrite networking-services data via a crafted mD | 1.1% | — |
| CVE-2011-4968 | MED 4.8 | debian debian_linux nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM) | 4.0% | — |
| CVE-2010-5175 | MED 4.8 | pwicorp privatefirewall Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-spa | 0.3% | — |
| CVE-2003-1428 | MED 4.8 | bharat_mediratta gallery Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos. | 0.5% | — |
| CVE-2026-58156 | MED 4.9 | apache traffic_server Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad | 0.2% | — |
| CVE-2026-42797 | MED 4.9 | apache syncope Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User | 0.4% | — |
| CVE-2026-42780 | MED 4.9 | f5 big-ip_ssl_orchestrator A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files. Note: Software versions which have reached End of Technical Support (EoTS) a | 0.9% | — |
| CVE-2026-42063 | MED 4.9 | f5 big-ip_access_policy_manager A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.3% | — |
| CVE-2026-41954 | MED 4.9 | f5 big-ip_access_policy_manager Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software v | 0.3% | — |
| CVE-2026-41280 | MED 4.9 | apache dolphinscheduler Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which | 0.4% | — |
| CVE-2026-39811 | MED 4.9 | fortinet fortiweb A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to denial of service via <insert attack ve | 0.4% | — |
| CVE-2026-23795 | MED 4.9 | apache syncope Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby caus | 1.9% | — |
| CVE-2026-22549 | MED 4.9 | f5 big-ip_container_ingress_services A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.3% | — |
| CVE-2026-20174 | MED 4.9 | cisco nexus_dashboard A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient validation of the metadata update file. | 0.5% | — |
| CVE-2026-20148 | MED 4.9 | cisco identity_services_engine A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrati | 6.9% | — |
| CVE-2026-20003 | MED 4.9 | cisco secure_firewall_management_center A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could e | 0.3% | — |
| CVE-2026-12702 | MED 4.9 | octopus octopus_server In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment. | 0.2% | — |