58.165 CVE tracked
789 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.165 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2023-24862 | MED 5.5 | microsoft windows_10_1507 Windows Secure Channel Denial of Service Vulnerability | 0.5% | — |
| CVE-2023-21697 | MED 6.2 | microsoft windows_10 Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability | 0.5% | — |
| CVE-2022-38408 | HIGH 7.8 | adobe illustrator Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interac | 0.5% | — |
| CVE-2021-29755 | HIGH 7.5 | ibm qradar_security_information_and_event_manager IBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter-host communications. IBM X-Force ID: 202015. | 0.5% | — |
| CVE-2022-0617 | MED 5.5 | debian debian_linux A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc | 0.5% | — |
| CVE-2021-1256 | MED 6.0 | cisco secure_firewall_threat_defense A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite files on the file system of an affected device by using directory traversal techniques. A successful exploit could cause syste | 0.5% | — |
| CVE-2019-15921 | MED 4.7 | linux linux_kernel An issue was discovered in the Linux kernel before 5.0.6. There is a memory leak issue when idr_alloc() fails in genl_register_family() in net/netlink/genetlink.c. | 0.5% | — |
| CVE-2018-6555 | HIGH 7.8 | canonical ubuntu_linux The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other i | 0.5% | — |
| CVE-2017-12134 | HIGH 8.8 | citrix xenserver The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leverag | 0.5% | — |
| CVE-2007-4786 | MED 5.3 | cisco adaptive_security_appliance_software Cisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1, 7.1 before 7.1.2.61, 7.2 before 7.2.2.34, and 8.0 before 8.0.2.11, when AAA is enabled, composes %ASA-5-111008 messages from the "test aaa" command with cleartext passwords and sends them | 0.5% | — |
| CVE-2026-76409 | HIGH 8.8 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple int | 0.5% | — |
| CVE-2026-76985 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option | 0.5% | — |
| CVE-2026-76984 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement | 0.5% | — |
| CVE-2026-76983 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label | 0.5% | — |
| CVE-2026-76982 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already | 0.5% | — |
| CVE-2026-75802 | MED 5.4 | apache wicket AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model value | 0.5% | — |
| CVE-2026-48326 | CRIT 9.9 | adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could | 0.5% | — |
| CVE-2026-56157 | MED 5.4 | microsoft sharepoint_server Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 0.5% | — |
| CVE-2026-56193 | HIGH 7.1 | microsoft 365_apps Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 0.5% | — |
| CVE-2026-25190 | HIGH 7.8 | microsoft windows_10_1607 Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. | 0.5% | — |
| CVE-2025-59251 | HIGH 7.6 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 0.5% | — |
| CVE-2022-49872 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: gso: fix panic on frag_list with mixed head alloc types Since commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list"), | 0.5% | — |
| CVE-2022-49201 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ibmvnic: fix race between xmit and reset There is a race between reset and the transmit paths that can lead to ibmvnic_xmit() accessing an scrq after it has been freed in the reset path. It | 0.5% | — |
| CVE-2024-56719 | CRIT 10.0 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s member | 0.5% | — |
| CVE-2024-56703 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6_select_path under high next hop churn Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using t | 0.5% | — |