56.571 CVE tracked
773 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.571 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-45642 | LOW 3.9 | microsoft windows_10_1607 Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack. | 0.3% | — |
| CVE-2024-26246 | LOW 3.9 | microsoft edge Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2023-36555 | LOW 3.9 | fortinet fortios An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components. | 0.3% | — |
| CVE-2023-23939 | LOW 3.9 | microsoft azure_setup_kubectl Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action be | 0.4% | — |
| CVE-2023-20867 | LOW 3.9 | debian debian_linux A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. | 13.5% | |
| CVE-2022-30307 | LOW 3.9 | fortinet fortios A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack. | 0.5% | — |
| CVE-2020-1987 | LOW 3.9 | paloaltonetworks globalprotect An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Net | 0.3% | — |
| CVE-2019-3591 | LOW 3.9 | mcafee data_loss_prevention_endpoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in | 0.8% | — |
| CVE-2019-0127 | LOW 3.9 | intel openvino Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure via local access. | 0.4% | — |
| CVE-2026-45498 | MED 4.0 | microsoft defender_antimalware_platform Microsoft Defender Denial of Service Vulnerability | 63.1% | |
| CVE-2026-41714 | MED 4.0 | vmware spring_advanced_message_queuing_protocol Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 | 0.1% | — |
| CVE-2026-18018 | MED 4.0 | google chrome Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low) | 0.1% | — |
| CVE-2026-10998 | MED 4.0 | google chrome Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read via malicious network traffic. (Chromium security severity: Medium) | 0.1% | — |
| CVE-2025-55717 | MED 4.0 | fortinet fortimail A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiR | 0.1% | — |
| CVE-2025-54255 | MED 4.0 | adobe acrobat Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could result in a security feature bypass impacting integrity. An attacker does not have to be authenticated | 0.3% | — |
| CVE-2025-49728 | MED 4.0 | microsoft pc_manager Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally. | 0.2% | — |
| CVE-2025-29839 | MED 4.0 | microsoft windows_10_1507 Out-of-bounds read in Windows File Server allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2025-20144 | MED 4.0 | cisco ios_xr A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect handling of packets when a specifi | 0.3% | — |
| CVE-2025-1348 | MED 4.0 | ibm sterling_b2b_integrator IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 could allow a local user to obtain sensitive information from a user’s web browser cache due to not using a suitable caching policy. | 0.1% | — |
| CVE-2023-52597 | MED 4.0 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporari | 0.2% | — |
| CVE-2023-47704 | MED 4.0 | ibm security_guardium_key_lifecycle_manager IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220. | 0.6% | — |
| CVE-2023-4458 | MED 4.0 | linux linux_kernel A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to | 0.8% | — |
| CVE-2023-43035 | MED 4.0 | ibm sterling_control_center IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system. | 0.2% | — |
| CVE-2023-39197 | MED 4.0 | fedoraproject fedora An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. | 1.0% | — |
| CVE-2023-39180 | MED 4.0 | linux linux_kernel A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of | 1.4% | — |