Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,463
- Last 24h
- 627
- Critical, 7 days
- 342
- Known exploited
- 1,779
472 results · Clear filters · Feed
-
Critical 9.8
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privil…
KEV Feb 4, 2025 -
Critical 9.8
Richfaces vulnerable to arbitrary code execution
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4…
KEV Sep 28, 2023 -
Critical 9.8
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…
KEV Nov 3, 2021 -
Critical 9.8
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir pa…
KEV Dec 18, 2024 -
Critical 9.1
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated…
KEV Dec 1, 2021 -
Critical 9.8
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible b…
KEV Mar 25, 2022 -
Critical 9.8
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_a…
KEV Mar 31, 2022 -
Critical 9.8
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?image…
KEV Mar 31, 2022 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). …
KEV Sep 8, 2022 -
Critical 9.8
Spring Data Commons remote code injection vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can sup…
KEV Mar 25, 2022 -
Critical 9.8
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
KEV Nov 3, 2021 -
Critical 9.8
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remo…
KEV Sep 8, 2022 -
Critical 9.8
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…
KEV Nov 3, 2021 -
Critical 9.8
Deserialization of Untrusted Data in Jenkins
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the…
KEV Oct 2, 2025 -
Critical 9.8
Inadequate Encryption Strength
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
KEV Jan 10, 2022 -
Critical 9.8
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote…
KEV Aug 18, 2022 -
Critical 9.8
Deserialization of Untrusted Data in Apache commons collections
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …
-
Critical 9.8
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter…
KEV Dec 10, 2021 -
Critical 9.8
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_add…
KEV Mar 25, 2022 -
Critical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…
KEV Apr 11, 2022 -
Critical 9.8
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …
KEV Jan 26, 2023 -
Critical 9.8
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as …
KEV Mar 25, 2022 -
Critical 9.8
Code execution in Apache Struts 1 plugin
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
KEV Feb 10, 2022 -
Critical 9.8
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…
KEV Nov 3, 2021 -
Critical 9.8
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., ex…
KEV Feb 15, 2022 -
Critical 9.8
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 200…
KEV May 24, 2022 -
Critical 9.8
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, all…
KEV Mar 30, 2023 -
Critical 9.8
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 1…
KEV Mar 5, 2026 -
Critical 9.8
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Man…
KEV Jan 28, 2022 -
Critical 9.8
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier ha…
KEV Feb 24, 2025 -
Critical 9.8
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgea…
KEV Mar 25, 2022 -
Critical 9.8
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 i…
KEV Nov 3, 2021 -
Critical 9.8
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software c…
KEV Mar 25, 2022 -
Critical 9.8
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …
KEV Nov 3, 2021 -
Critical 9.8
ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitr…
KEV Mar 7, 2022 -
Critical 9.8
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.c…
KEV Mar 25, 2022 -
Critical 9.8
Remote code execution in PHPMailer
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
KEV Jul 7, 2025 -
Critical 9.8
Improper Access Control in Apache Shiro
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
KEV Nov 3, 2021 -
Critical 9.8
Improper Input Validation in Apache ActiveMQ
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
KEV Feb 10, 2022 -
Critical 9.8
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arb…
KEV Jun 9, 2022