57.479 CVE tracked
782 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.479 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-45863 | MED 6.4 | linux linux_kernel An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write. | 0.3% | — |
| CVE-2023-3863 | MED 6.4 | debian debian_linux A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue. | 0.2% | — |
| CVE-2023-33203 | MED 6.4 | linux linux_kernel The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device. | 0.4% | — |
| CVE-2023-3282 | MED 6.4 | paloaltonetworks cortex_xsoar A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local attacker to execute programs with elevated privileges if the attacker has shell access to the engine. | 0.2% | — |
| CVE-2023-30772 | MED 6.4 | linux linux_kernel The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device. | 0.5% | — |
| CVE-2023-29182 | MED 6.4 | fortinet fortios A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary code via specially crafted CLI commands, provided the attacker were able to evade FortiOS stack protections. | 0.3% | — |
| CVE-2023-28002 | MED 6.4 | fortinet fortios An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious imag | 0.2% | — |
| CVE-2023-23781 | MED 6.4 | fortinet fortiweb A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML server configuration may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted XML | 0.7% | — |
| CVE-2023-23481 | MED 6.4 | ibm sterling_partner_engagement_manager IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentia | 0.4% | — |
| CVE-2023-22946 | MED 6.4 | apache spark In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-relat | 1.1% | — |
| CVE-2023-0012 | MED 6.4 | sap host_agent In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAP | 0.2% | — |
| CVE-2022-45888 | MED 6.4 | linux linux_kernel An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device. | 0.7% | — |
| CVE-2022-44034 | MED 6.4 | linux linux_kernel An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between scr24x_op | 0.3% | — |
| CVE-2022-44033 | MED 6.4 | linux linux_kernel An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_op | 0.3% | — |
| CVE-2022-44032 | MED 6.4 | linux linux_kernel An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cmm_open( | 0.3% | — |
| CVE-2022-4382 | MED 6.4 | linux linux_kernel A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side. | 0.5% | — |
| CVE-2022-41950 | MED 6.4 | super_xray_project super_xray super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurate default xray permissions. Note: this vulnerability only affects Linux and Mac OS systems. Users sho | 0.4% | — |
| CVE-2022-41086 | MED 6.4 | microsoft windows_10 Windows Group Policy Elevation of Privilege Vulnerability | 0.3% | — |
| CVE-2022-21963 | MED 6.4 | microsoft windows_10 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2022-20826 | MED 6.4 | cisco adaptive_security_appliance_software A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated attacker with physical acc | 0.3% | — |
| CVE-2021-44750 | MED 6.4 | f-secure client_security An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands. | 0.7% | — |
| CVE-2021-41029 | MED 6.4 | fortinet fortiwlm A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests | 0.5% | — |
| CVE-2021-38669 | MED 6.4 | microsoft edge Microsoft Edge (Chromium-based) Tampering Vulnerability | 2.9% | — |
| CVE-2021-37159 | MED 6.4 | debian debian_linux hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free. | 0.4% | — |
| CVE-2021-3573 | MED 6.4 | fedoraproject fedora A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_ad | 0.4% | — |