57.971 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.971 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-35323 | HIGH 7.8 | microsoft windows_11_21h2 Windows OLE Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2023-35313 | HIGH 7.8 | microsoft windows_10_1507 Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2023-23377 | HIGH 7.8 | microsoft 3d_builder 3D Builder Remote Code Execution Vulnerability | 0.7% | — |
| CVE-2022-23764 | HIGH 8.8 | teruten webcube The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution. | 0.7% | — |
| CVE-2022-30611 | MED 5.4 | ibm spectrum_copy_data_management IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using some fields of the form in the portal UI to inject | 0.7% | — |
| CVE-2022-26788 | HIGH 7.8 | microsoft powershell PowerShell Elevation of Privilege Vulnerability | 0.7% | — |
| CVE-2021-0208 | HIGH 8.8 | juniper junos An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS allows an attacker to send a malformed RSVP packet when bidirectional LSPs are in use, which when received by an egress router crashes the RPD | 0.7% | — |
| CVE-2019-15266 | MED 4.4 | cisco wireless_lan_controller_software A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to view system files that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in command-line pa | 0.7% | — |
| CVE-2019-12620 | MED 5.3 | cisco hyperflex_hx220c_af_m5_firmware A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to inject arbitrary values on an affected device. The vulnerability is due to insufficient authentication for the statistics collec | 0.7% | — |
| CVE-2014-4027 | LOW 2.3 | canonical ubuntu_linux The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access t | 0.7% | — |
| CVE-2010-3689 | MED 6.9 | apache openoffice soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. | 0.7% | — |
| CVE-2026-55126 | HIGH 7.3 | microsoft sharepoint_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.6% | — |
| CVE-2026-40961 | HIGH 7.2 | apache airflow A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to `apache-ai | 0.6% | — |
| CVE-2025-4178 | MED 5.4 | xiaowei1118 java_server A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects some unknown processing of the file /src/main/java/com/changyu/foryou/controller/FoodController.java o | 0.6% | — |
| CVE-2024-53868 | HIGH 7.5 | apache traffic_server Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes t | 0.6% | — |
| CVE-2024-43614 | MED 5.5 | microsoft defender_for_endpoint Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally. | 0.6% | — |
| CVE-2024-38097 | HIGH 7.1 | microsoft azure_monitor_agent Azure Monitor Agent Elevation of Privilege Vulnerability | 0.6% | — |
| CVE-2024-29991 | MED 5.0 | microsoft edge_chromium Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 0.6% | — |
| CVE-2024-21377 | MED 5.5 | microsoft windows_10_1507 Windows DNS Information Disclosure Vulnerability | 0.6% | — |
| CVE-2023-28982 | HIGH 7.5 | juniper junos A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In a BGP rib sharding scen | 0.6% | — |
| CVE-2023-28964 | HIGH 7.5 | juniper junos An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause an RPD crash leading to a Denial of Service (D | 0.6% | — |
| CVE-2020-3590 | MED 6.4 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management in | 0.6% | — |
| CVE-2020-3587 | MED 6.4 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management in | 0.6% | — |
| CVE-2019-6663 | MED 5.5 | f5 big-ip_access_policy_manager The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) at | 0.6% | — |
| CVE-2014-3321 | MED 5.7 | cisco asr_9000_rsp440_router Cisco IOS XR 4.3.4 and earlier on ASR 9000 devices, when bridge-group virtual interface (BVI) routing is enabled, allows remote attackers to cause a denial of service (chip and card hangs) via a series of crafted MPLS packets, aka Bug ID CSCuo91149. | 0.6% | — |