57.479 CVE tracked
782 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.479 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-3519 | MED 6.4 | lenovo ideacentre_3-07imb05_firmware A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes. | 0.2% | — |
| CVE-2021-34706 | MED 6.4 | cisco identity_services_engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an affected device. This | 0.7% | — |
| CVE-2021-31959 | MED 6.4 | microsoft windows_10 Scripting Engine Memory Corruption Vulnerability | 9.2% | — |
| CVE-2021-3061 | MED 6.4 | paloaltonetworks pan-os An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions e | 0.9% | — |
| CVE-2021-26096 | MED 6.4 | fortinet fortisandbox Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content by means of specifically crafted command line arguments. | 0.8% | — |
| CVE-2021-22131 | MED 6.4 | fortinet fortitoken_mobile A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed v | 0.1% | — |
| CVE-2021-22004 | MED 6.4 | fedoraproject fedora An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour | 0.4% | — |
| CVE-2021-20261 | MED 6.4 | linux linux_kernel A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the per | 0.2% | — |
| CVE-2021-1507 | MED 6.4 | cisco sd-wan_vmanage A vulnerability in an API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the application web-based interface. This vulnerability exists because the API does | 0.6% | — |
| CVE-2021-1483 | MED 6.4 | cisco catalyst_sd-wan_manager A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. This vulnerability is due to improper handling of XML External | 0.9% | — |
| CVE-2021-1482 | MED 6.4 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain access to sensitive information on an affected system. This vulnerability is du | 0.6% | — |
| CVE-2021-0920 | MED 6.4 | debian debian_linux In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: | 0.9% | |
| CVE-2020-7804 | MED 6.4 | handysoft groupware ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method. | 1.0% | — |
| CVE-2020-4757 | MED 6.4 | ibm content_navigator IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credenti | 1.3% | — |
| CVE-2020-3590 | MED 6.4 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management in | 0.6% | — |
| CVE-2020-3587 | MED 6.4 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management in | 0.6% | — |
| CVE-2020-25285 | MED 6.4 | canonical ubuntu_linux A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812. | 0.3% | — |
| CVE-2020-17135 | MED 6.4 | microsoft azure_devops_server Azure DevOps Server Spoofing Vulnerability | 1.3% | — |
| CVE-2020-15706 | MED 6.4 | canonical ubuntu_linux GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restri | 1.0% | — |
| CVE-2020-15705 | MED 6.4 | canonical ubuntu_linux GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is boote | 1.4% | — |
| CVE-2019-1879 | MED 6.4 | cisco integrated_management_controller A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied in | 0.4% | — |
| CVE-2019-1732 | MED 6.4 | cisco nx-os A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which | 0.4% | — |
| CVE-2019-15214 | MED 6.4 | canonical ubuntu_linux An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c. | 0.6% | — |
| CVE-2019-1238 | MED 6.4 | microsoft internet_explorer A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1239. | 5.9% | — |
| CVE-2019-1193 | MED 6.4 | microsoft edge A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who | 3.1% | — |