56.580 CVE tracked
773 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.580 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2019-0671 | HIGH 7.8 | microsoft office A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0 | 14.8% | — |
| CVE-2024-26209 | MED 5.5 | microsoft windows_10_1507 Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability | 14.8% | — |
| CVE-2012-0156 | MED 4.3 | microsoft windows_7 DirectWrite in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly render Unicode characters, which allows remote attackers to cause a denial of service (application hang) via a (1) instant message | 14.8% | — |
| CVE-2007-1530 | MED 5.0 | microsoft windows_vista The LLTD Mapper in Microsoft Windows Vista does not properly gather responses to EMIT packets, which allows remote attackers to cause a denial of service (mapping failure) by omitting an ACK response, which triggers an XML syntax error. | 14.8% | — |
| CVE-2018-0883 | HIGH 7.5 | microsoft windows_10 Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerabili | 14.8% | — |
| CVE-2007-4288 | MED 4.3 | microsoft windows_media_player Microsoft Windows Media Player 11 (wmplayer.exe) allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted .au file that triggers a divide-by-zero error, as demonstrated by iapetus.au. | 14.8% | — |
| CVE-2000-1006 | MED 5.0 | microsoft exchange_server Microsoft Exchange Server 5.5 does not properly handle a MIME header with a blank charset specified, which allows remote attackers to cause a denial of service via a charset="" command, aka the "Malformed MIME Header" vulnerability. | 14.8% | — |
| CVE-2004-0869 | MED 5.0 | microsoft ie Internet Explorer does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cr | 14.8% | — |
| CVE-2001-0238 | HIGH 7.5 | microsoft windows_2000 Microsoft Data Access Component Internet Publishing Provider 8.103.2519.0 and earlier allows remote attackers to bypass Security Zone restrictions via WebDAV requests. | 14.8% | — |
| CVE-2025-20265 | CRIT 10.0 | cisco secure_firewall_management_center A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This vulnerability is | 14.8% | — |
| CVE-2017-3807 | HIGH 8.8 | cisco adaptive_security_appliance_software A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-9.6, could allow an authenticated, remote attacker to cause a heap overflow. The vulnerability is due to insufficient va | 14.8% | — |
| CVE-2006-3510 | LOW 2.6 | microsoft ie The Remote Data Service Object (RDS.DataControl) in Microsoft Internet Explorer 6 on Windows 2000 allows remote attackers to cause a denial of service (crash) via a series of operations that result in an invalid length calculation when using SysAllocStringLen, | 14.8% | — |
| CVE-2002-1294 | HIGH 7.5 | microsoft java_virtual_machine The Microsoft Java implementation, as used in Internet Explorer, can provide HTML object references to applets via Javascript, which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthor | 14.7% | — |
| CVE-1999-0294 | MED 5.0 | microsoft wins All records in a WINS database can be deleted through SNMP for a denial of service. | 14.7% | — |
| CVE-2014-0315 | MED 6.9 | microsoft windows_7 Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows | 14.7% | — |
| CVE-2016-3293 | HIGH 7.5 | microsoft edge Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability." | 14.7% | — |
| CVE-2017-0240 | HIGH 7.5 | microsoft edge A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0221 and CVE-2017-0 | 14.7% | — |
| CVE-2001-0244 | HIGH 7.5 | microsoft index_server Buffer overflow in Microsoft Index Server 2.0 allows remote attackers to execute arbitrary commands via a long search parameter. | 14.7% | — |
| CVE-2001-0334 | HIGH 7.5 | microsoft internet_information_server FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string when it is expanded. | 14.7% | — |
| CVE-2015-6051 | MED 4.3 | microsoft internet_explorer Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Internet Explorer Elevation of Privilege Vulnerability." | 14.7% | — |
| CVE-2014-1820 | MED 4.3 | microsoft sql_server Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "SQL Master Data Services XSS Vulnerabili | 14.7% | — |
| CVE-2010-1939 | HIGH 7.6 | apple safari Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window's close method, which triggers imprope | 14.7% | — |
| CVE-2021-21042 | MED 6.5 | adobe acrobat Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to arbitrary disclosure of information in the memory stack. An attacker c | 14.7% | — |
| CVE-2021-44715 | LOW 3.3 | adobe acrobat Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory st | 14.7% | — |
| CVE-2000-0053 | HIGH 7.5 | microsoft commercial_internet_system Microsoft Commercial Internet System (MCIS) IMAP server allows remote attackers to cause a denial of service via a malformed IMAP request. | 14.7% | — |