58.912 CVE seguite
800 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.912 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2026-77486 | HIGH 8.8 | microsoft sql_server_2017 Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-77485 | HIGH 7.0 | microsoft sql_server_2017 Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-77484 | HIGH 8.8 | microsoft sql_server_2019 Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | 1,7% | — |
| CVE-2026-77483 | HIGH 8.8 | microsoft sql_server_2017 Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. | 0,8% | — |
| CVE-2026-77482 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-77481 | HIGH 8.8 | microsoft sql_server_2017 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 0,9% | — |
| CVE-2026-77480 | HIGH 8.8 | microsoft sql_server_2017 Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 0,8% | — |
| CVE-2026-77180 | HIGH 8.3 | When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without san | 0,5% | — |
| CVE-2026-77105 | HIGH 8.8 | commvault commvault CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server. | 0,3% | — |
| CVE-2026-77104 | HIGH 7.5 | commvault commvault CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. | 0,6% | — |
| CVE-2026-77103 | HIGH 7.5 | commvault commvault CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. | 0,5% | — |
| CVE-2026-77102 | HIGH 7.5 | commvault commvault CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe. | 0,5% | — |
| CVE-2026-77101 | HIGH 7.5 | commvault commvault CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe. | 0,5% | — |
| CVE-2026-76986 | MED 6.1 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — | 0,6% | — |
| CVE-2026-76985 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option | 0,5% | — |
| CVE-2026-76984 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement | 0,5% | — |
| CVE-2026-76983 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label | 0,5% | — |
| CVE-2026-76982 | MED 5.4 | apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already | 0,5% | — |
| CVE-2026-7667 | HIGH 8.8 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary fi | 0,6% | — |
| CVE-2026-76646 | HIGH 7.5 | A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to vers | 0,6% | — |
| CVE-2026-76519 | CRIT 9.8 | cisco asyncos A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of ema | 1,7% | — |
| CVE-2026-76451 | MED 4.9 | cisco identity_services_engine A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficie | 0,4% | — |
| CVE-2026-76450 | MED 4.9 | cisco identity_services_engine A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficie | 0,4% | — |
| CVE-2026-76449 | MED 4.9 | cisco identity_services_engine A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficie | 0,4% | — |
| CVE-2026-76448 | MED 4.9 | cisco identity_services_engine A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficie | 0,4% | — |