57.084 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.084 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2016-1315 | HIGH 7.5 | cisco email_security_appliance_firmeware The proxy engine in Cisco Advanced Malware Protection (AMP), when used with Email Security Appliance (ESA) 9.5.0-201, 9.6.0-051, and 9.7.0-125, allows remote attackers to bypass intended content restrictions via a malformed e-mail message containing an encoded | 1.4% | — |
| CVE-2011-0638 | MED 6.9 | microsoft windows Microsoft Windows does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse dat | 1.4% | — |
| CVE-2023-49299 | HIGH 8.8 | apache dolphinscheduler Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to ver | 1.4% | — |
| CVE-2022-22487 | CRIT 9.8 | ibm spectrum_protect_server An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using bru | 1.4% | — |
| CVE-2022-21899 | MED 5.5 | microsoft windows_10 Windows Extensible Firmware Interface Security Feature Bypass Vulnerability | 1.4% | — |
| CVE-2019-8922 | HIGH 8.8 | bluez bluez A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requeste | 1.4% | — |
| CVE-2021-24007 | CRIT 9.8 | fortinet fortimail Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | 1.4% | — |
| CVE-2018-15424 | MED 4.7 | cisco identity_services_engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web se | 1.4% | — |
| CVE-2018-0025 | MED 6.1 | juniper junos When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests | 1.4% | — |
| CVE-2018-0888 | MED 5.6 | microsoft windows_10 The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 a | 1.4% | — |
| CVE-2015-8963 | HIGH 7.0 | linux linux_kernel Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation. | 1.4% | — |
| CVE-2009-2453 | HIGH 7.5 | citrix presentation_server Citrix XenApp (formerly Presentation Server) 4.5 Hotfix Rollup Pack 3 does not apply an access policy when it is defined with the Access Gateway Advanced Edition filters, which allows attackers to bypass intended access restrictions via unknown vectors. | 1.4% | — |
| CVE-2025-59247 | HIGH 8.8 | microsoft azure_playfab Azure PlayFab Elevation of Privilege Vulnerability | 1.4% | — |
| CVE-2025-53716 | MED 6.5 | microsoft windows_10_1809 Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. | 1.4% | — |
| CVE-2025-50172 | MED 6.5 | microsoft windows_10_1809 Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network. | 1.4% | — |
| CVE-2024-43589 | HIGH 8.8 | microsoft windows_server_2008 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 1.4% | — |
| CVE-2023-26268 | MED 4.4 | apache couchdb Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as | 1.4% | — |
| CVE-2022-43766 | HIGH 7.5 | apache iotdb Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to a | 1.4% | — |
| CVE-2021-3057 | HIGH 8.1 | paloaltonetworks globalprotect A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProtec | 1.4% | — |
| CVE-2021-1261 | HIGH 7.8 | cisco catalyst_sd-wan_manager Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more informa | 1.4% | — |
| CVE-2021-1260 | HIGH 7.8 | cisco catalyst_sd-wan_manager Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which could allow the attacker to take certain actions with root privileges on the device. For more informa | 1.4% | — |
| CVE-2019-1423 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1420, CVE-2019-1422. | 1.4% | — |
| CVE-2013-3436 | MED 5.0 | cisco ios The default configuration of the Group Encrypted Transport VPN (GET VPN) feature on Cisco IOS uses an improper mechanism for enabling Group Domain of Interpretation (GDOI) traffic flow, which allows remote attackers to bypass the encryption policy via certain | 1.4% | — |
| CVE-2020-1616 | MED 5.3 | juniper advanced_threat_protection Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention (JATP) Series and Virtual JATP (vJATP) devices allows an unauthenticated, remote attacker to perfor | 1.4% | — |
| CVE-2020-0871 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when Windows Network Connections Service fails to properly handle objects in memory, aka 'Windows Network Connections Service Information Disclosure Vulnerability'. | 1.4% | — |