Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,413
- Last 24h
- 697
- Critical, 7 days
- 339
- Known exploited
- 1,779
472 results · Clear filters · Feed
-
Critical 10.0
LoadMaster Pre-Authenticated OS Command Injection
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
KEV Nov 18, 2024 -
Critical 10.0
Authentication bypass using an alternate path or channel
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
KEV Feb 22, 2024 -
Critical 9.8
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0…
KEV Oct 9, 2024 -
Critical 9.8
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
KEV Feb 6, 2025 -
Critical 9.6
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0…
KEV Feb 9, 2024 -
Critical 9.8
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files …
KEV Aug 19, 2024 -
Critical 10.0
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated att…
KEV Jan 24, 2024 -
Critical 9.1
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,…
KEV Jan 10, 2024 -
Critical 10.0
Weak Password Recovery Mechanism for Forgotten Password in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account passwor…
KEV May 1, 2024 -
Critical 10.0
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relie…
KEV Nov 30, 2023 -
Critical 9.8
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wi…
KEV Aug 27, 2026 -
Critical 9.8
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a …
KEV Nov 13, 2023 -
Critical 10.0
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authori…
KEV Nov 7, 2023 -
Critical 10.0
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …
KEV Nov 2, 2023 -
Critical 9.8
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have …
KEV Oct 31, 2023 -
Critical 9.8
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that…
KEV May 20, 2024 -
Critical 10.0
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IO…
KEV Oct 16, 2023 -
Critical 9.4
Unauthenticated sensitive information disclosure
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
KEV Oct 18, 2023 -
Critical 10.0
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…
KEV Oct 5, 2023 -
Critical 10.0
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
KEV Oct 5, 2023 -
Critical 9.8
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
KEV Oct 4, 2023 -
Critical 9.6
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and ea…
KEV Dec 7, 2023 -
Critical 9.8
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an…
KEV Aug 22, 2023 -
Critical 9.8
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker …
KEV Nov 13, 2023 -
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted f…
KEV Jan 18, 2024 -
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or r…
KEV Jul 25, 2023 -
Critical 9.8
Unauthenticated remote code execution
KEV Jul 19, 2023 -
Critical 9.8
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…
KEV Aug 16, 2023 -
Critical 9.8
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
KEV Jan 10, 2024 -
Critical 9.2
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, vers…
KEV Jun 13, 2023 -
Critical 9.8
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMwar…
KEV Jun 22, 2023 -
Critical 9.8
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023…
KEV Jun 2, 2023 -
Critical 9.4
Remote Code injection in Barracuda Email Security Gateway
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar f…
KEV May 26, 2023 -
Critical 9.8
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attack…
KEV Sep 6, 2023 -
Critical 9.8
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware ver…
KEV May 31, 2023 -
Critical 9.8
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…
KEV Apr 21, 2023 -
Critical 9.8
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.1…
KEV Nov 16, 2023 -
Critical 9.8
Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
KEV Mar 14, 2023 -
Critical 9.8
IBM Aspera Faspex code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…
KEV Feb 21, 2023 -
Critical 9.8
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Age…
KEV Feb 10, 2023