57.622 CVE tracked
783 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.622 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-21135 | MED 6.5 | google chrome Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 19.2% | — |
| CVE-2021-21134 | MED 6.5 | google chrome Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page. | 5.0% | — |
| CVE-2021-21133 | MED 6.5 | google chrome Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass navigation restrictions via a crafted HTML page. | 3.0% | — |
| CVE-2021-21131 | MED 6.5 | google chrome Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | 7.6% | — |
| CVE-2021-21130 | MED 6.5 | google chrome Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | 5.4% | — |
| CVE-2021-21129 | MED 6.5 | google chrome Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | 5.4% | — |
| CVE-2021-21126 | MED 6.5 | google chrome Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. | 8.7% | — |
| CVE-2021-21123 | MED 6.5 | google chrome Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. | 10.9% | — |
| CVE-2021-21078 | MED 6.5 | adobe creative_cloud_desktop_application Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by an Unquoted Service Path vulnerability in CCXProcess that could allow an attacker to achieve arbitrary code execution in the process of the current user. Exploitation of this iss | 1.1% | — |
| CVE-2021-21070 | MED 6.5 | adobe robohelp Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with admin permissions to write to the file system could leverage this vulnerability to escalate | 1.6% | — |
| CVE-2021-21042 | MED 6.5 | adobe acrobat Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to arbitrary disclosure of information in the memory stack. An attacker c | 14.7% | — |
| CVE-2021-20579 | MED 6.5 | ibm db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTO_REVAL is set to DEFFERED_FORCE. IBM X-Force ID: 199283. | 1.1% | — |
| CVE-2021-20573 | MED 6.5 | ibm security_identity_manager_adapter IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated attacker could overflow the and cause the server to crash. IBM X-Force ID: 199249. | 1.5% | — |
| CVE-2021-20572 | MED 6.5 | ibm security_identity_manager_adapter IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A remote authenticated attacker could overflow the and cause the server to crash. IBM X-Force ID: 199247. | 1.5% | — |
| CVE-2021-20488 | MED 6.5 | ibm security_identity_manager IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. IBM X-Force ID: 1 | 0.9% | — |
| CVE-2021-20486 | MED 6.5 | ibm cloud_pak_for_data IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668. | 0.9% | — |
| CVE-2021-20483 | MED 6.5 | ibm security_identity_manager IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197591. | 0.9% | — |
| CVE-2021-20480 | MED 6.5 | ibm websphere_application_server IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502. | 1.3% | — |
| CVE-2021-20445 | MED 6.5 | ibm maximo_for_civil_infrastructure IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621. | 1.3% | — |
| CVE-2021-20433 | MED 6.5 | ibm security_guardium IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 196345. | 0.9% | — |
| CVE-2021-20432 | MED 6.5 | ibm spectrum_protect_plus IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Fo | 0.7% | — |
| CVE-2021-20431 | MED 6.5 | ibm i2_analysts_notebook IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342. | 0.9% | — |
| CVE-2021-1721 | MED 6.5 | microsoft .net .NET Core and Visual Studio Denial of Service Vulnerability | 3.3% | — |
| CVE-2021-1679 | MED 6.5 | microsoft windows_10 Windows CryptoAPI Denial of Service Vulnerability | 3.5% | — |
| CVE-2021-1618 | MED 6.5 | cisco intersight_virtual_appliance Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to i | 2.7% | — |