56.560 CVE tracked
773 Exploited now
181 Used by ransomware
Last sync
CVE Tracker
56.560 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-20701 | CRIT 10.0 | cisco rv340_firmware Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization prot | 9.7% | |
| CVE-2022-20700 | CRIT 10.0 | cisco rv160_firmware Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization prot | 5.7% | |
| CVE-2022-20699 | CRIT 10.0 | cisco rv340_firmware Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization prot | 72.5% | |
| CVE-2022-20695 | CRIT 10.0 | cisco wireless_lan_controller_8.10.151.0 A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability i | 19.9% | — |
| CVE-2021-44228 | CRIT 10.0 | ransomware apache log4j Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who c | 100.0% | |
| CVE-2021-42313 | CRIT 10.0 | microsoft defender_for_iot Microsoft Defender for IoT Remote Code Execution Vulnerability | 3.8% | — |
| CVE-2021-42311 | CRIT 10.0 | microsoft defender_for_iot Microsoft Defender for IoT Remote Code Execution Vulnerability | 4.0% | — |
| CVE-2021-40113 | CRIT 10.0 | cisco catalyst_pon_switch_cgp-ont-1p_firmware Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a de | 4.6% | — |
| CVE-2021-40112 | CRIT 10.0 | cisco catalyst_pon_switch_cgp-ont-1p_firmware Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a de | 1.4% | — |
| CVE-2021-37705 | CRIT 10.0 | microsoft onefuzz OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable One | 2.4% | — |
| CVE-2021-34795 | CRIT 10.0 | cisco catalyst_pon_switch_cgp-ont-1p_firmware Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a de | 1.7% | — |
| CVE-2021-34770 | CRIT 10.0 | cisco ios_xe A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, remote attacker to execute arbitrary code with a | 3.0% | — |
| CVE-2021-26472 | CRIT 10.0 | vembu bdr_suite In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges. | 2.5% | — |
| CVE-2021-1388 | CRIT 10.0 | cisco aci_multi-site_orchestrator A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper toke | 14.4% | — |
| CVE-2021-0248 | CRIT 10.0 | juniper junos This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker to take over any instance of an NFX deployment. This issue is only exploitable through administrative | 1.0% | — |
| CVE-2021-0211 | CRIT 10.0 | juniper junos An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon (RPD) service allows an attacker to send a valid BGP FlowSpec message thereby causing an unexpected change in the route advertisem | 1.3% | — |
| CVE-2020-2021 | CRIT 10.0 | ransomware paloaltonetworks pan-os When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based | 4.4% | |
| CVE-2020-1953 | CRIT 10.0 | apache commons_configuration Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default s | 6.8% | — |
| CVE-2020-1614 | CRIT 10.0 | juniper junos A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. | 1.4% | — |
| CVE-2020-1467 | CRIT 10.0 | microsoft windows_10 An elevation of privilege vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. To exploit this vulnerability, an attacker would | 3.5% | — |
| CVE-2020-1350 | CRIT 10.0 | microsoft windows_server_2008 A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 91.4% | |
| CVE-2020-12389 | CRIT 10.0 | mozilla firefox The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. | 1.7% | — |
| CVE-2020-12388 | CRIT 10.0 | mozilla firefox The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. | 2.7% | — |
| CVE-2020-0796 | CRIT 10.0 | ransomware microsoft windows_10_1903 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. | 99.8% | |
| CVE-2019-9548 | CRIT 10.0 | citrix application_delivery_management Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control. | 1.5% | — |