56.571 CVE seguite
773 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.571 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2025-29827 | CRIT 9.9 | microsoft azure_automation Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. | 1,5% | — |
| CVE-2025-21415 | CRIT 9.9 | microsoft azure_ai_face_service Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. | 0,9% | — |
| CVE-2025-20333 | CRIT 9.9 | cisco adaptive_security_appliance_software A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. | 40,4% | |
| CVE-2025-20286 | CRIT 9.9 | cisco identity_services_engine A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrat | 1,1% | — |
| CVE-2025-20156 | CRIT 9.9 | cisco meeting_management A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced | 1,2% | — |
| CVE-2025-20124 | CRIT 9.9 | cisco identity_services_engine A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affect | 18,5% | — |
| CVE-2025-13032 | CRIT 9.9 | avast antivirus Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow. | 0,2% | — |
| CVE-2024-45387 | CRIT 9.9 | apache traffic_control An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-craf | 41,8% | — |
| CVE-2024-43602 | CRIT 9.9 | microsoft azure_cyclecloud Azure CycleCloud Remote Code Execution Vulnerability | 2,3% | — |
| CVE-2024-25693 | CRIT 9.9 | esri portal_for_arcgis There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory. | 1,3% | — |
| CVE-2024-23538 | CRIT 9.9 | apache fineract Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue. | 1,3% | — |
| CVE-2024-20432 | CRIT 9.9 | cisco nexus_dashboard_fabric_controller A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to i | 1,1% | — |
| CVE-2024-20424 | CRIT 9.9 | cisco secure_firewall_management_center A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operat | 0,9% | — |
| CVE-2024-20329 | CRIT 9.9 | cisco adaptive_security_appliance_software A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to execute operating system commands as root. This vulnerability is due to insufficient validation of user input. An attac | 1,2% | — |
| CVE-2024-20253 | CRIT 9.9 | cisco unified_communications_manager A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provide | 2,4% | — |
| CVE-2023-41373 | CRIT 9.9 | f5 big-ip_access_policy_manager A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross | 2,4% | — |
| CVE-2023-40714 | CRIT 9.9 | fortinet fortisiem A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements | 0,6% | — |
| CVE-2023-35893 | CRIT 9.9 | ibm security_guardium IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824. | 1,4% | — |
| CVE-2023-34063 | CRIT 9.9 | vmware aria_automation Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows. | 0,9% | — |
| CVE-2023-27874 | CRIT 9.9 | ibm aspera_faspex IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845. | 1,3% | — |
| CVE-2023-20048 | CRIT 9.9 | cisco secure_firewall_management_center A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by | 15,8% | — |
| CVE-2023-20036 | CRIT 9.9 | cisco industrial_network_director A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input valid | 12,7% | — |
| CVE-2022-38652 | CRIT 9.9 | vmware hyperic_agent A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with | 0,8% | — |
| CVE-2022-37425 | CRIT 9.9 | opennebula opennebula Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion. | 1,6% | — |
| CVE-2022-20780 | CRIT 9.9 | cisco enterprise_nfv_infrastructure_software Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the | 11,2% | — |