60.304 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.304 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2025-59277 | HIGH 7.8 | microsoft windows_10_1507 Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2025-59275 | HIGH 7.8 | microsoft windows_10_1507 Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2025-59273 | HIGH 7.3 | microsoft azure_event_grid Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network. | 0,4% | — |
| CVE-2025-59272 | CRIT 9.3 | microsoft 365_copilot_chat Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally. | 0,6% | — |
| CVE-2025-59271 | HIGH 8.7 | microsoft azure_cache_for_redis Redis Enterprise Elevation of Privilege Vulnerability | 0,7% | — |
| CVE-2025-59269 | MED 6.1 | f5 big-ip_access_policy_manager A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of T | 0,3% | — |
| CVE-2025-59268 | MED 5.3 | f5 big-ip_access_policy_manager On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are no | 0,4% | — |
| CVE-2025-59261 | HIGH 7.0 | microsoft windows_11_22h2 Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 0,2% | — |
| CVE-2025-59260 | MED 5.5 | microsoft windows_server_2016 Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information locally. | 0,4% | — |
| CVE-2025-59259 | MED 6.5 | microsoft windows_10_1507 Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. | 1,5% | — |
| CVE-2025-59258 | MED 6.2 | microsoft windows_server_2012 Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally. | 0,6% | — |
| CVE-2025-59257 | MED 6.5 | microsoft windows_11_24h2 Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. | 1,5% | — |
| CVE-2025-59255 | HIGH 7.8 | microsoft windows_10_1809 Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 0,4% | — |
| CVE-2025-59254 | HIGH 7.8 | microsoft windows_10_1507 Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | 1,1% | — |
| CVE-2025-59253 | MED 5.5 | microsoft windows_10_1507 Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally. | 0,3% | — |
| CVE-2025-59252 | CRIT 9.3 | microsoft 365_word_copilot Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network. | 0,6% | — |
| CVE-2025-59251 | HIGH 7.6 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 0,5% | — |
| CVE-2025-59250 | HIGH 8.1 | microsoft jdbc_driver_for_sql_server Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network. | 0,7% | — |
| CVE-2025-59249 | HIGH 8.8 | microsoft exchange_server Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | 0,8% | — |
| CVE-2025-59248 | HIGH 7.5 | microsoft exchange_server Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 1,0% | — |
| CVE-2025-59247 | HIGH 8.8 | microsoft azure_playfab Azure PlayFab Elevation of Privilege Vulnerability | 1,6% | — |
| CVE-2025-59246 | CRIT 9.8 | microsoft entra_id Azure Entra ID Elevation of Privilege Vulnerability | 7,6% | — |
| CVE-2025-59245 | CRIT 9.8 | microsoft sharepoint_online Microsoft SharePoint Online Elevation of Privilege Vulnerability | 1,1% | — |
| CVE-2025-59244 | MED 6.5 | microsoft windows_10_1507 External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network. | 0,8% | — |
| CVE-2025-59243 | HIGH 7.8 | microsoft 365_apps Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 0,4% | — |