56.793 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.793 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-21134 | MED 6.5 | google chrome Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page. | 5.0% | — |
| CVE-2018-0341 | HIGH 8.8 | cisco ip_phone_multiplatform_firmware A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remote attacker to perform a command injection and execute commands with the privileges of the web server | 5.0% | — |
| CVE-2021-36005 | HIGH 7.8 | adobe photoshop Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) is affected by a stack overflow vulnerability due to insecure handling of a crafted PSD file, potentially resulting in arbitrary code execution in the context of the current user. Exploitat | 5.0% | — |
| CVE-2018-0850 | MED 6.5 | microsoft office Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of privilege vulnerability due to how the format of incoming message is validated, aka "Microsoft Outlook | 5.0% | — |
| CVE-2020-13923 | MED 5.3 | apache ofbiz IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04 | 5.0% | — |
| CVE-2020-0637 | MED 6.5 | microsoft windows_server_2008 An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote Desktop Web Access Information Disclosure Vulnerability'. | 5.0% | — |
| CVE-2018-17200 | CRIT 9.8 | apache ofbiz The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream | 5.0% | — |
| CVE-2009-0199 | HIGH 9.3 | vmware ace Heap-based buffer overflow in the VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 | 5.0% | — |
| CVE-2000-1139 | HIGH 7.5 | microsoft exchange_server The installation of Microsoft Exchange 2000 before Rev. A creates a user account with a known password, which could allow attackers to gain privileges, aka the "Exchange User Account" vulnerability. | 5.0% | — |
| CVE-2019-1917 | CRIT 9.1 | cisco vision_dynamic_signage_director A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker | 5.0% | — |
| CVE-2008-0535 | HIGH 7.8 | cisco service_control_engine Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device instability) via "SSH credentials that attempt to ch | 5.0% | — |
| CVE-2017-2928 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. Successful exploitation could lead to arbitrary code execution. | 5.0% | — |
| CVE-2017-2925 | HIGH 8.8 | adobe flash_player Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability in the JPEG XR codec. Successful exploitation could lead to arbitrary code execution. | 5.0% | — |
| CVE-1999-1222 | MED 5.0 | microsoft windows_nt Netbt.sys in Windows NT 4.0 allows remote malicious DNS servers to cause a denial of service (crash) by returning 0.0.0.0 as the IP address for a DNS host name lookup. | 5.0% | — |
| CVE-2012-0174 | LOW 1.7 | microsoft windows_7 Windows Firewall in tcpip.sys in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly enforce firewall rules for outbound broadcast packets, which allows remote attackers to obtain potentially sensi | 5.0% | — |
| CVE-2019-13565 | HIGH 7.5 | apple mac_os_x An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for | 5.0% | — |
| CVE-2017-8637 | MED 5.3 | microsoft edge Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to bypass Arbitrary Code Guard (ACG) due to how Microsoft Edge accesses memory in code compiled by the Edge Just-In-Time (JIT) compiler, aka "Scripting Engine Security Feature Bypass Vulnerability" | 5.0% | — |
| CVE-1999-0227 | MED 5.0 | microsoft windows_nt Access violation in LSASS.EXE (LSA/LSARPC) program in Windows NT allows a denial of service. | 5.0% | — |
| CVE-2009-2696 | MED 4.3 | apache tomcat Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web | 5.0% | — |
| CVE-2026-50507 | MED 6.8 | microsoft windows_10_1607 Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | 5.0% | — |
| CVE-2019-16765 | HIGH 7.4 | microsoft codeql If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of t | 5.0% | — |
| CVE-2018-8238 | HIGH 7.8 | microsoft lync A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for Business and Lync Security Feature Bypass Vulnerability." This affects Skype, Microsoft Lync. | 5.0% | — |
| CVE-2019-0968 | MED 5.5 | microsoft windows_7 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. There are | 5.0% | — |
| CVE-2016-3320 | MED 4.9 | fedoraproject fedora Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow attackers to bypass the Secure Boot protection mechanism by leveraging (1) administrative or (2) physical access to install a crafted boot manager, aka " | 5.0% | — |
| CVE-2019-10744 | CRIT 9.1 | f5 big-ip_access_policy_manager Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. | 5.0% | — |