59.529 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
Vulnerabilità sfruttate attivamente
803 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2024-53150 | HIGH 7.1 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, | 1,4% | |
| CVE-2024-49035 | HIGH 8.7 | microsoft partner_center An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. | 1,3% | |
| CVE-2026-45498 | MED 4.0 | microsoft defender_antimalware_platform Microsoft Defender Denial of Service Vulnerability | 1,3% | |
| CVE-2026-102489 | CRIT 9.8 | zammad zammad Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework. | 1,3% | |
| CVE-2026-0322 | HIGH 7.2 | paloaltonetworks pan-os A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by t | 1,2% | |
| CVE-2023-36851 | MED 5.3 | juniper junos A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.ph | 1,1% | |
| CVE-2025-61624 | MED 6.0 | fortinet fortios An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPA | 1,1% | |
| CVE-2026-3910 | HIGH 8.8 | google chrome Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | 1,1% | |
| CVE-2025-22225 | HIGH 8.2 | ransomware vmware cloud_foundation VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. | 1,0% | |
| CVE-2026-8452 | CRIT 9.8 | citrix netscaler_application_delivery_controller Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server | 1,0% | |
| CVE-2026-56164 | MED 5.3 | microsoft sharepoint_server Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | 1,0% | |
| CVE-2026-20349 | HIGH 8.6 | cisco adaptive_security_appliance_software A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unex | 1,0% | |
| CVE-2026-8398 | CRIT 9.8 | disc-soft daemon_tools A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attacker | 1,0% | |
| CVE-2021-0920 | MED 6.4 | debian debian_linux In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: | 0,9% | |
| CVE-2021-44168 | LOW 3.3 | fortinet fortios A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages. | 0,9% | |
| CVE-2026-53266 | HIGH 8.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the brid | 0,8% | |
| CVE-2024-50302 | MED 5.5 | debian debian_linux In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be | 0,8% | |
| CVE-2026-53362 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are co | 0,7% | |
| CVE-2026-5281 | HIGH 8.8 | google chrome Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | 0,7% | |
| CVE-2026-88779 | HIGH 7.5 | citrix netscaler_application_delivery_controller Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28. | 0,6% | |
| CVE-2026-102490 | HIGH 7.8 | zammad zammad Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as | 0,5% | |
| CVE-2026-42897 | HIGH 8.1 | microsoft exchange_server Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 0,5% | |
| CVE-2026-41091 | HIGH 7.8 | microsoft malware_protection_engine Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally. | 0,4% | |
| CVE-2026-33825 | HIGH 7.8 | ransomware microsoft defender_antimalware_platform Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. | 0,4% | |
| CVE-2026-81963 | HIGH 7.8 | microsoft windows_11_23h2 Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. | 0,4% |