56.784 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
Ricerca: http
2708 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2025-66723 | HIGH 7.5 | inmusicbrands engine_dj_desktop inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths. | 0,4% | — |
| CVE-2024-43856 | HIGH 7.8 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: dma: fix call order in dmam_free_coherent dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the dat | 0,4% | — |
| CVE-2021-1354 | MED 4.3 | cisco unified_computing_system_central_software A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager (UCSM). This vulnerability is due to imp | 0,4% | — |
| CVE-2025-20269 | MED 6.5 | cisco evolved_programmable_network_manager A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system | 0,4% | — |
| CVE-2026-73180 | MED 6.8 | apache tomcat Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not b | 0,4% | — |
| CVE-2025-41414 | HIGH 7.5 | f5 big-ip_access_policy_manager When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 0,4% | — |
| CVE-2025-36557 | HIGH 7.5 | f5 big-ip_access_policy_manager When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are | 0,4% | — |
| CVE-2024-56694 | HIGH 7.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: bpf: fix recursive lock when verdict program return SK_PASS When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock event | 0,4% | — |
| CVE-2026-22720 | HIGH 8.0 | vmware aria_operations VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, | 0,4% | — |
| CVE-2023-41836 | LOW 3.5 | fortinet fortisandbox An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, | 0,4% | — |
| CVE-2026-63038 | CRIT 9.8 | apache inlong Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects A | 0,4% | — |
| CVE-2026-43826 | MED 6.5 | apache apache-airflow-providers-opensearch The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read | 0,4% | — |
| CVE-2026-41018 | MED 6.5 | apache apache-airflow-providers-elasticsearch The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log r | 0,4% | — |
| CVE-2026-34477 | MED 5.9 | apache log4j The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2 | 0,4% | — |
| CVE-2026-50420 | MED 6.2 | microsoft windows_11_24h2 Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally. | 0,4% | — |
| CVE-2026-30796 | HIGH 7.5 | rustdesk rustdesk_server Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attac | 0,4% | — |
| CVE-2025-20113 | HIGH 7.1 | cisco unified_contact_center_express A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system. This vulnerability is due to insufficient server-side validation | 0,4% | — |
| CVE-2020-17534 | HIGH 7.0 | apache html\/java_api There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in | 0,4% | — |
| CVE-2024-54026 | MED 4.3 | fortinet fortisandbox An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, Fo | 0,4% | — |
| CVE-2025-46706 | HIGH 7.5 | f5 big-ip_access_policy_manager When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0,4% | — |
| CVE-2025-20196 | MED 5.3 | cisco 807_industrial_integrated_services_router_firmware A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Cisco IOx application hosting environment to stop responding, resulting in a denial of | 0,4% | — |
| CVE-2025-20190 | MED 6.5 | cisco ios_xe A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient acce | 0,4% | — |
| CVE-2025-30658 | HIGH 7.5 | juniper junos A Missing Release of Memory after Effective Lifetime vulnerability in the Anti-Virus processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX platforms with Anti-V | 0,4% | — |
| CVE-2023-27998 | MED 5.3 | fortinet fortipresence A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating | 0,4% | — |
| CVE-2020-5867 | HIGH 8.1 | f5 nginx_controller In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages | 0,4% | — |