57.139 CVE tracked
777 Exploited now
184 Used by ransomware
Last sync
CVE Tracker
57.139 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-1999-0843 | MED 5.0 | cisco router Denial of service in Cisco routers running NAT via a PORT command from an FTP client to a Telnet port. | 1.4% | — |
| CVE-2024-29834 | MED 6.4 | apache pulsar This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the t | 1.4% | — |
| CVE-2024-20667 | HIGH 7.5 | microsoft azure_devops_server Azure DevOps Server Remote Code Execution Vulnerability | 1.4% | — |
| CVE-2019-17183 | HIGH 7.5 | foxitsoftware reader Foxit Reader before 9.7 allows an Access Violation and crash if insufficient memory exists. | 1.4% | — |
| CVE-2014-3396 | HIGH 7.5 | cisco asr_9000_rsp440_router Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133. | 1.4% | — |
| CVE-1999-0222 | MED 5.0 | cisco router Denial of service in Cisco IOS web server allows attackers to reboot the router using a long URL. | 1.4% | — |
| CVE-2025-47856 | HIGH 7.2 | fortinet fortivoice Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or comman | 1.4% | — |
| CVE-2025-29954 | MED 5.9 | microsoft windows_10_1507 Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. | 1.4% | — |
| CVE-2025-26628 | HIGH 7.3 | microsoft azure_local_cluster Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally. | 1.4% | — |
| CVE-2021-47548 | CRIT 9.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port le | 1.4% | — |
| CVE-2024-20287 | MED 6.5 | cisco wap371_firmware A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This vul | 1.4% | — |
| CVE-2022-2170 | MED 4.8 | microsoft microsoft_advertising_universal_event_tracking The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is di | 1.4% | — |
| CVE-2021-21982 | CRIT 9.1 | vmware carbon_black_cloud_workload VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid au | 1.4% | — |
| CVE-2020-1614 | CRIT 10.0 | juniper junos A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. | 1.4% | — |
| CVE-2018-13384 | MED 6.1 | fortinet fortios A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison HTTP cache and subsequently redirect SSL VPN web portal users to arbitrary web domains. | 1.4% | — |
| CVE-2019-1678 | MED 4.3 | cisco meeting_server A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Meetings application users who are paired with a Session Initiation Protocol (SIP) endpoint. The vulnerability is due to i | 1.4% | — |
| CVE-2017-9797 | MED 6.5 | apache geode When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, a | 1.4% | — |
| CVE-2012-1514 | MED 6.8 | vmware vshield_manager Cross-site request forgery (CSRF) vulnerability in VMware vShield Manager (vSM) 1.0.1 before Update 2 and 4.1.0 before Update 2 allows remote attackers to hijack the authentication of arbitrary users. | 1.4% | — |
| CVE-2007-6723 | MED 4.3 | anonymityanywhere tork TorK before 0.22, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended acc | 1.4% | — |
| CVE-2026-21518 | HIGH 8.8 | microsoft visual_studio_code Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 1.4% | — |
| CVE-2017-5031 | HIGH 8.8 | google chrome A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | 1.4% | — |
| CVE-2016-1274 | HIGH 7.5 | juniper junos Juniper Junos OS 14.1X53 before 14.1X53-D30 on QFX Series switches allows remote attackers to cause a denial of service (PFE panic) via a high rate of unspecified VXLAN packets. | 1.4% | — |
| CVE-2025-25005 | MED 6.5 | microsoft exchange_server Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. | 1.4% | — |
| CVE-2024-38212 | HIGH 8.8 | microsoft windows_server_2008 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 1.4% | — |
| CVE-2020-16914 | MED 5.5 | microsoft windows_10 <p>An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not a | 1.4% | — |