59.223 CVE tracked
800 Exploited now
188 Used by ransomware
Last sync
Cisco vulnerabilities
6717 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-1284 | HIGH 8.8 | cisco catalyst_sd-wan_manager A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and authorization and modify the configuration of an affected system. To exploit this vulne | 0.4% | — |
| CVE-2025-20274 | MED 6.3 | cisco unified_contact_center_express A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uplo | 0.4% | — |
| CVE-2025-20183 | MED 5.8 | cisco asyncos A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious fil | 0.4% | — |
| CVE-2023-20230 | MED 5.4 | cisco application_policy_infrastructure_controller A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to read, modify, or delete non-tenant policies (for example, access policies) created by | 0.4% | — |
| CVE-2020-3173 | HIGH 7.8 | cisco ucs_manager A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) on an affected device. The vulnerability is due to insuffi | 0.4% | — |
| CVE-2015-4279 | HIGH 7.2 | cisco unified_computing_system The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778. | 0.4% | — |
| CVE-2026-20199 | MED 4.7 | cisco thousandeyes_virtual_appliance A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to execute commands on the underlying operating system as the root user. This vulnerability is due to insufficient validati | 0.4% | — |
| CVE-2023-20179 | MED 4.3 | cisco sd-wan_vmanage A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied da | 0.4% | — |
| CVE-2019-1836 | HIGH 7.1 | cisco nx-os A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to use symbolic links to overwrite system files. These system files may be sensitive a | 0.4% | — |
| CVE-2015-4237 | MED 4.6 | cisco nx-os The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CS | 0.4% | — |
| CVE-2024-20390 | MED 5.3 | cisco ios_xr A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of in | 0.4% | — |
| CVE-2020-3577 | HIGH 7.4 | cisco secure_firewall_threat_defense A vulnerability in the ingress packet processing path of Cisco Firepower Threat Defense (FTD) Software for interfaces that are configured either as Inline Pair or in Passive mode could allow an unauthenticated, adjacent attacker to cause a denial of service (D | 0.4% | — |
| CVE-2018-0428 | MED 6.7 | cisco web_security_appliance A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due | 0.4% | — |
| CVE-2015-6385 | HIGH 7.2 | cisco ios The publish-event event-manager feature in Cisco IOS 15.5(2)S and 15.5(3)S on Cloud Services Router 1000V devices allows local users to execute arbitrary commands with root privileges by leveraging administrative access to enter crafted environment variables, | 0.4% | — |
| CVE-2015-4185 | MED 6.9 | cisco ios The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202. | 0.4% | — |
| CVE-2022-20961 | HIGH 8.8 | cisco identity_services_engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vul | 0.4% | — |
| CVE-2020-3216 | MED 6.8 | cisco ios_xe_sd-wan A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insuffic | 0.4% | — |
| CVE-2019-12717 | HIGH 7.8 | cisco nx-os A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. The vulnerability is | 0.4% | — |
| CVE-2023-20063 | HIGH 8.2 | cisco secure_firewall_management_center A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that are running Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to e | 0.4% | — |
| CVE-2021-1308 | HIGH 7.4 | cisco rv132w_firmware Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjacent attacker could execute arbitrary code or cause an affected router to leak system memory or reload | 0.4% | — |
| CVE-2021-1251 | HIGH 7.4 | cisco rv132w_firmware Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjacent attacker could execute arbitrary code or cause an affected router to leak system memory or reload | 0.4% | — |
| CVE-2017-12239 | MED 6.8 | cisco ios_xe A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, physical attacker to access an affected device's operating system. The | 0.4% | — |
| CVE-2023-20151 | MED 6.1 | cisco rv016_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the int | 0.4% | — |
| CVE-2023-20150 | MED 6.1 | cisco rv016_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the int | 0.4% | — |
| CVE-2023-20149 | MED 6.1 | cisco rv016_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the int | 0.4% | — |