58.165 CVE tracked
789 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.165 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2003-0246 | LOW 3.6 | linux linux_kernel The ioperm system call in Linux kernel 2.4.20 and earlier does not properly restrict privileges, which allows local users to gain read or write access to certain I/O ports. | 0.5% | — |
| CVE-2026-20146 | MED 5.5 | cisco identity_services_engine A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary fil | 0.5% | — |
| CVE-2026-47288 | HIGH 7.1 | microsoft windows_server_2012 Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network. | 0.5% | — |
| CVE-2026-31476 | HIGH 8.2 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRE | 0.5% | — |
| CVE-2026-20136 | MED 6.0 | cisco identity_services_engine A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges to perform a command injection attack on the underlying opera | 0.5% | — |
| CVE-2026-40023 | MED 5.3 | apache log4cxx Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, ND | 0.5% | — |
| CVE-2026-20957 | HIGH 7.8 | microsoft 365_apps Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2025-64899 | HIGH 7.8 | adobe acrobat Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure | 0.5% | — |
| CVE-2025-59208 | HIGH 7.1 | microsoft windows_10_1507 Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network. | 0.5% | — |
| CVE-2025-54104 | MED 6.7 | microsoft windows_10_1507 Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-50173 | HIGH 7.8 | microsoft windows_10_1507 Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2024-53880 | MED 4.9 | nvidia triton_inference_server NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparound error by loading a model with an extra-large file size that overflows an internal variable. A successful exploit of thi | 0.5% | — |
| CVE-2024-43553 | HIGH 7.4 | microsoft windows_10_1507 NT OS Kernel Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2024-21586 | HIGH 7.5 | juniper junos An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series and NFX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an a | 0.5% | — |
| CVE-2024-22268 | HIGH 7.1 | vmware fusion VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to create a denial | 0.5% | — |
| CVE-2023-42098 | LOW 3.3 | foxit pdf_editor Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerabil | 0.5% | — |
| CVE-2024-20357 | MED 5.9 | cisco ip_phone_6821_with_multiplatform_firmware A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because bounds-checking does not occur while parsing XML requests. An at | 0.5% | — |
| CVE-2024-23607 | MED 5.5 | f5 f5os-a A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.5% | — |
| CVE-2023-41742 | HIGH 7.5 | acronis agent Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979. | 0.5% | — |
| CVE-2022-20769 | HIGH 7.4 | cisco wireless_lan_controller_software A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insuff | 0.5% | — |
| CVE-2019-1972 | MED 6.7 | cisco enterprise_nfv_infrastructure_software A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating sys | 0.5% | — |
| CVE-2019-11191 | LOW 2.5 | linux linux_kernel The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and t | 0.5% | — |
| CVE-2014-9892 | MED 5.5 | google android The snd_compr_tstamp function in sound/core/compress_offload.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly initialize a timestamp data structure, which allows attackers to obtain sens | 0.5% | — |
| CVE-2014-3183 | MED 6.9 | linux linux_kernel Heap-based buffer overflow in the logi_dj_ll_raw_request function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a craf | 0.5% | — |
| CVE-2012-0028 | HIGH 7.2 | linux linux_kernel The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child proce | 0.5% | — |