57.620 CVE tracked
783 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.620 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-30073 | HIGH 7.8 | microsoft windows_10_1507 Windows Security Zone Mapping Security Feature Bypass Vulnerability | 0.9% | — |
| CVE-2024-30330 | HIGH 7.8 | foxit pdf_editor Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that | 0.9% | — |
| CVE-2023-44250 | HIGH 8.8 | fortinet fortios An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted | 0.9% | — |
| CVE-2022-27878 | MED 6.8 | f5 big-ip_access_policy_manager On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration u | 0.9% | — |
| CVE-2022-20763 | MED 5.4 | cisco webex_meetings_online A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attacker to inject arbitrary Java code. This vulnerability is due to improper deserialization of Java code within login requests. An attacker cou | 0.9% | — |
| CVE-2021-22016 | MED 6.1 | vmware cloud_foundation The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link. | 0.9% | — |
| CVE-2017-1000365 | HIGH 7.8 | linux linux_kernel The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limi | 0.9% | — |
| CVE-2016-8495 | HIGH 7.4 | fortinet fortimanager_firmware An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack via the Fortisandbox devices probing feature. | 0.9% | — |
| CVE-2024-26308 | MED 5.5 | apache commons_compress Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue. | 0.9% | — |
| CVE-2023-41314 | HIGH 8.2 | apache doris The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues. | 0.9% | — |
| CVE-2023-42783 | HIGH 7.5 | fortinet fortiwlm A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests. | 0.9% | — |
| CVE-2023-28232 | HIGH 7.5 | microsoft windows_10_1507 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2022-0804 | MED 6.5 | google chrome Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. | 0.9% | — |
| CVE-2022-0802 | MED 6.5 | google chrome Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. | 0.9% | — |
| CVE-2020-4877 | CRIT 9.8 | ibm cognos_controller IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 190843. | 0.9% | — |
| CVE-2021-41375 | MED 4.4 | microsoft azure_sphere Azure Sphere Information Disclosure Vulnerability | 0.9% | — |
| CVE-2021-38657 | MED 6.1 | microsoft 365_apps Microsoft Office Graphics Component Information Disclosure Vulnerability | 0.9% | — |
| CVE-2020-4688 | HIGH 7.8 | ibm security_guardium IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injection vulnerability. IBM X-Force ID: 186700. | 0.9% | — |
| CVE-2020-16941 | MED 4.1 | microsoft sharepoint_enterprise_server <p>An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts | 0.9% | — |
| CVE-2020-0730 | HIGH 7.1 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'. | 0.9% | — |
| CVE-2016-4066 | HIGH 8.8 | fortinet fortiweb Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for requests that change the password via unspecified vectors. | 0.9% | — |
| CVE-2003-1579 | MED 4.3 | sun one_web_server Sun ONE (aka iPlanet) Web Server 6 on Windows, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses v | 0.9% | — |
| CVE-2025-29817 | MED 5.7 | microsoft power_automate_for_desktop Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. | 0.9% | — |
| CVE-2024-38172 | HIGH 7.8 | microsoft 365_apps Microsoft Excel Remote Code Execution Vulnerability | 0.9% | — |
| CVE-2023-20103 | MED 4.9 | cisco secure_network_analytics A vulnerability in Cisco Secure Network Analytics could allow an authenticated, remote attacker to execute arbitrary code as a root user on an affected device. This vulnerability is due to insufficient validation of user input to the web interface. An attacker | 0.9% | — |