58.273 CVE tracked
789 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.273 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-56207 | CRIT 9.8 | apache impala Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version | 0.5% | — |
| CVE-2026-78452 | MED 4.6 | microsoft windows_10_1809 Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information with a physical attack. | 0.5% | — |
| CVE-2026-77898 | HIGH 7.5 | microsoft 365_apps Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | 0.5% | — |
| CVE-2026-69548 | MED 4.6 | microsoft windows_10_1607 Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack. | 0.5% | — |
| CVE-2026-62720 | MED 6.5 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | 0.5% | — |
| CVE-2026-62716 | MED 6.5 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | 0.5% | — |
| CVE-2026-62714 | MED 6.5 | microsoft windows_10_1607 Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | 0.5% | — |
| CVE-2026-64281 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or sc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state across transp | 0.5% | — |
| CVE-2026-49794 | MED 4.6 | microsoft windows_10_1607 Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. | 0.5% | — |
| CVE-2026-47898 | CRIT 9.8 | apache lucene.net Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade | 0.5% | — |
| CVE-2025-62449 | MED 6.8 | microsoft github_copilot_chat Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally. | 0.5% | — |
| CVE-2025-49743 | MED 6.7 | microsoft windows_10_1507 Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 0.5% | — |
| CVE-2025-38018 | HIGH 7.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel panic when alloc_page failed We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_s | 0.5% | — |
| CVE-2024-20469 | MED 6.0 | cisco identity_services_engine A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, | 0.5% | — |
| CVE-2022-48919 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_fre | 0.5% | — |
| CVE-2021-47559 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() Coverity reports a possible NULL dereferencing problem: in smc_vlan_by_tcpsk(): 6. returned_null: netdev_lower_get_next return | 0.5% | — |
| CVE-2024-28905 | HIGH 7.8 | microsoft windows_server_2022_23h2 Microsoft Brokering File System Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2023-4550 | HIGH 7.5 | opentext appbuilder Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on | 0.5% | — |
| CVE-2023-24930 | HIGH 7.8 | microsoft onedrive Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability | 0.5% | — |
| CVE-2022-20969 | MED 4.8 | cisco umbrella A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the Cisco Umbrella dashboard. This vulnerability is due to unsanitized us | 0.5% | — |
| CVE-2022-30676 | MED 5.5 | adobe indesign Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploit | 0.5% | — |
| CVE-2022-30675 | MED 5.5 | adobe indesign Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploit | 0.5% | — |
| CVE-2022-30673 | MED 5.5 | adobe indesign Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploit | 0.5% | — |
| CVE-2022-30672 | MED 5.5 | adobe indesign Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploit | 0.5% | — |
| CVE-2022-30671 | MED 5.5 | adobe indesign Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploit | 0.5% | — |