57.588 CVE tracked
783 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.588 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-29488 | MED 4.3 | sabnzbd sabnzbd SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as p | 0.9% | — |
| CVE-2020-1393 | HIGH 7.8 | microsoft visual_studio An elevation of privilege vulnerability exists when the Windows Diagnostics Hub Standard Collector Service fails to properly sanitize input, leading to an unsecure library-loading behavior, aka 'Windows Diagnostics Hub Elevation of Privilege Vulnerability'. Th | 0.9% | — |
| CVE-2020-1336 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenti | 0.9% | — |
| CVE-2020-15523 | HIGH 7.8 | netapp snapcenter In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid | 0.9% | — |
| CVE-2016-4931 | MED 6.5 | juniper junos_space XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. | 0.9% | — |
| CVE-2026-41604 | HIGH 8.2 | apache thrift Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. | 0.9% | — |
| CVE-2026-32647 | HIGH 7.8 | f5 nginx_open_source NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a speci | 0.9% | — |
| CVE-2025-62206 | MED 6.5 | microsoft dynamics_365 Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2025-55319 | HIGH 8.8 | microsoft visual_studio_code Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. | 0.9% | — |
| CVE-2025-30473 | HIGH 8.8 | apache airflow_common_sql_provider Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI | 0.9% | — |
| CVE-2024-51504 | CRIT 9.1 | apache zookeeper When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection | 0.9% | — |
| CVE-2023-32214 | HIGH 7.5 | mozilla firefox Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thund | 0.9% | — |
| CVE-2021-40331 | HIGH 8.1 | apache ranger An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue af | 0.9% | — |
| CVE-2022-2639 | HIGH 7.8 | linux linux_kernel An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potent | 0.9% | — |
| CVE-2021-3054 | HIGH 7.2 | paloaltonetworks pan-os A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts | 0.9% | — |
| CVE-2021-22920 | MED 6.5 | citrix application_delivery_management A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, co | 0.9% | — |
| CVE-2021-1265 | MED 6.5 | cisco catalyst_center A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration ar | 0.9% | — |
| CVE-2019-1655 | MED 6.1 | cisco webex_meetings_server A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerab | 0.9% | — |
| CVE-2018-15434 | MED 6.1 | cisco skinny_client_control_protocol_software A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected devic | 0.9% | — |
| CVE-2018-15400 | MED 6.1 | cisco cloud_services_platform_2100_firmware A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected devic | 0.9% | — |
| CVE-2018-0452 | MED 6.1 | cisco tetration_analytics A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vu | 0.9% | — |
| CVE-2018-0450 | MED 6.1 | cisco data_center_network_manager A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the management interface on an affected device. The vuln | 0.9% | — |
| CVE-2016-10295 | MED 4.7 | linux linux_kernel An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: | 0.9% | — |
| CVE-2025-53720 | HIGH 8.0 | microsoft windows_server_2008 Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. | 0.9% | — |
| CVE-2023-35336 | MED 6.5 | microsoft windows_10_1507 Windows MSHTML Platform Security Feature Bypass Vulnerability | 0.9% | — |