57.479 CVE tracked
782 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.479 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2017-6145 | HIGH 7.3 | f5 big-ip_access_policy_manager iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly | 1.1% | — |
| CVE-2025-62821 | CRIT 9.1 | microsoft heif_image_extension Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = str | 1.1% | — |
| CVE-2023-49068 | HIGH 7.5 | apache dolphinscheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure o | 1.1% | — |
| CVE-2023-35387 | HIGH 8.8 | microsoft windows_10_1507 Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2022-47500 | MED 6.1 | apache helix URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper des | 1.1% | — |
| CVE-2022-26979 | HIGH 7.5 | foxit pdf_editor Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a NULL pointer dereference when this.Span is used for oState of Collab.addStateModel, because this.Span.text can be NULL. | 1.1% | — |
| CVE-2022-27944 | HIGH 7.5 | foxit pdf_editor Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow an exportXFAData NULL pointer dereference. | 1.1% | — |
| CVE-2021-22043 | HIGH 7.5 | vmware esxi VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files. | 1.1% | — |
| CVE-2022-24955 | CRIT 9.8 | foxit pdf_editor Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files. | 1.1% | — |
| CVE-2020-29384 | MED 5.5 | advsys pngout An issue was discovered in PNGOUT 2020-01-15. When compressing a crafted PNG file, it encounters an integer overflow. | 1.1% | — |
| CVE-2017-0586 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produc | 1.1% | — |
| CVE-2017-0584 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Produc | 1.1% | — |
| CVE-2016-6440 | MED 6.5 | cisco unified_communications_manager The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.0(1.1000 | 1.1% | — |
| CVE-2012-1370 | LOW 3.5 | cisco anyconnect_secure_mobility_client Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 allows remote authenticated users to cause a denial of service (vpnagentd process crash) via a crafted packet, aka Bug ID CSCty01670. | 1.1% | — |
| CVE-2025-66518 | HIGH 8.8 | apache kyuubi Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10 | 1.1% | — |
| CVE-2024-23755 | HIGH 8.8 | clickup clickup ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode. | 1.1% | — |
| CVE-2023-47534 | CRIT 9.6 | fortinet forticlient_endpoint_management_server A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via | 1.1% | — |
| CVE-2020-27717 | HIGH 7.5 | f5 big-ip_domain_name_system On BIG-IP DNS 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, undisclosed series of DNS requests may cause TMM to restart and generate a core file. | 1.1% | — |
| CVE-2020-17126 | MED 5.5 | microsoft 365_apps Microsoft Excel Information Disclosure Vulnerability | 1.1% | — |
| CVE-2016-2072 | MED 6.1 | citrix netscaler The Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, 10.5.e before Build 59.1305.e, and 10.1 allows remote attackers to conduct clickjacking | 1.1% | — |
| CVE-2006-7034 | HIGH 7.5 | super_link_exchange_script super_link_exchange_script SQL injection vulnerability in directory.php in Super Link Exchange Script 1.0 might allow remote attackers to execute arbitrary SQL queries via the cat parameter. | 1.1% | — |
| CVE-2025-29819 | MED 6.2 | microsoft windows_admin_center External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally. | 1.1% | — |
| CVE-2024-49142 | HIGH 7.8 | microsoft 365_apps Microsoft Access Remote Code Execution Vulnerability | 1.1% | — |
| CVE-2022-41121 | HIGH 7.8 | microsoft powershell Windows Graphics Component Elevation of Privilege Vulnerability | 1.1% | — |
| CVE-2021-41333 | HIGH 7.8 | microsoft windows_10 Windows Print Spooler Elevation of Privilege Vulnerability | 1.1% | — |