Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
409,413
Last 24h
697
Critical, 7 days
339
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

472 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-47966 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due…

    KEV Jan 23, 2023
  • Critical 9.8
    CVE-2022-44877 Exploited Public exploit Scanner template EPSS 100%

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execu…

    KEV Jan 17, 2023
  • Critical 9.3
    CVE-2022-42475 Exploited · Ransomware Public exploit EPSS 99%

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…

    Fortinet FortiOS FortiProxy Network devices
    KEV Dec 13, 2022
  • Critical 9.8
    CVE-2022-27518 Exploited Public exploit

    Unauthenticated remote arbitrary code execution

    Unauthenticated remote arbitrary code execution

    Citrix Citrix Gateway, Citrix ADC Network devices
    KEV Dec 13, 2022
  • Critical 9.8
    CVE-2022-46169 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated Command Injection

    Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

    Cacti cacti cacti cacti Debian Ubuntu
    KEV Feb 16, 2023
  • Critical 9.8
    CVE-2022-31199 Exploited · Ransomware Public exploit EPSS 36%

    Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…

    KEV Jul 11, 2023
  • Critical 9.8
    CVE-2016-20017 Exploited Public exploit EPSS 66%

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…

    KEV Jan 8, 2024
  • Critical 9.8
    CVE-2022-40684 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

    Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Network devices
    KEV Oct 11, 2022
  • Critical 9.8
    CVE-2022-21587 Exploited · Ransomware Public exploit Scanner template EPSS 98%

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

    Oracle Web Applications Desktop Integrator
    KEV Feb 2, 2023
  • Critical 9.8
    CVE-2022-41352 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

    KEV Oct 20, 2022
  • Critical 9.8
    CVE-2022-35914 Exploited Public exploit Scanner template EPSS 100%

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    KEV Mar 7, 2023
  • Critical 9.8
    CVE-2022-37042 Exploited · Ransomware Public exploit Scanner template EPSS 92%

    Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts f…

    KEV Aug 11, 2022
  • Critical 9.8
    CVE-2022-26138 Exploited Public exploit Scanner template EPSS 98%

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…

    Atlassian Questions For Confluence Web / CMS
    KEV Jul 29, 2022
  • Critical 9.8
    CVE-2022-35405 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…

    KEV Sep 22, 2022
  • Critical 9.8
    CVE-2022-26352 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form re…

    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-26134 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

    Atlassian Confluence Server Confluence Data Center Web / CMS
    KEV Jun 2, 2022
  • Critical 9.8
    CVE-2022-29303 Exploited Public exploit Scanner template EPSS 98%

    SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

    KEV Jul 13, 2023
  • Critical 9.8
    CVE-2022-30525 Exploited Public exploit Scanner template EPSS 100%

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…

    Zyxel ATP series firmware VPN series Firmware USG FLEX 50(W) firmware Network devices
    KEV May 16, 2022
  • Critical 9.8
    CVE-2022-30333 Exploited · Ransomware Public exploit EPSS 99%

    RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …

    unrar-nonfree unrar-nonfree rar libclamunrar Debian Ubuntu
    KEV Aug 9, 2022
  • Critical 9.8
    CVE-2022-1388 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

    F5 BIG-IP Network devices
    KEV May 10, 2022
  • Critical 9.8
    CVE-2022-24706 Exploited Public exploit Scanner template EPSS 93%

    Remote Code Execution Vulnerability in Packaging

    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including re…

    Apache Software Foundation Apache CouchDB
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-21445 Exploited Public exploit EPSS 62%

    Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…

    Oracle Application Development Framework (ADF)
    KEV Sep 18, 2024
  • Critical 9.8
    CVE-2022-29464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fil…

    KEV Apr 25, 2022
  • Critical 10.0
    CVE-2022-24816 Exploited Public exploit Scanner template EPSS 100%

    Improper Control of Generation of Code in jai-ext

    JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and …

    geosolutions-it jai-ext it.geosolutions.jaiext.jiffle:jt-jiffle it.geosolutions.jaiext.jiffle:jt-jiffle-language Maven
    KEV Jun 26, 2024
  • Critical 9.8
    CVE-2022-22954 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templ…

    KEV Apr 14, 2022
  • Critical 9.8
    CVE-2022-22965 Exploited Public exploit Scanner template EPSS 100%

    Remote Code Execution in Spring Framework

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

    libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
    KEV Apr 4, 2022
  • Critical 9.8
    CVE-2022-22963 Exploited Public exploit Scanner template EPSS 100%

    Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …

    org.springframework.cloud:spring-cloud-function-context Maven
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-1040 Exploited Public exploit Scanner template EPSS 100%

    An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…

    Sophos Sophos Firewall Network devices
    KEV Mar 31, 2022
  • Critical 9.8
    CVE-2022-26318 Exploited Public exploit EPSS 78%

    On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulne…

    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2022-22947 Exploited Public exploit Scanner template EPSS 98%

    Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could al…

    org.springframework.cloud:spring-cloud-gateway Maven
    KEV May 16, 2022
  • Critical 10.0
    CVE-2022-0543 Exploited Public exploit Scanner template EPSS 99%

    It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specifi…

    Debian redis redis redis Debian Ubuntu
    KEV Mar 28, 2022
  • Critical 9.8
    CVE-2022-24086 Exploited Public exploit Scanner template EPSS 99%

    Adobe Commerce checkout improper input validation leads to remote code execution

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code e…

    Adobe Magento Commerce magento/community-edition Web / CMS Packagist
    KEV Feb 15, 2022
  • Critical 9.8
    CVE-2022-24112 Exploited Public exploit Scanner template EPSS 96%

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…

    Apache Software Foundation Apache APISIX
    KEV Aug 25, 2022
  • Critical 10.0
    CVE-2022-20699 Exploited Public exploit EPSS 72%

    Cisco Small Business RV Series Routers Vulnerabilities

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…

    Cisco Cisco Small Business RV Series Router Firmware Network devices
    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2022-22536 Exploited Public exploit Scanner template EPSS 98%

    SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…

    SAP SAP NetWeaver and ABAP Platform SAP Web Dispatcher SAP Content Server
    KEV Aug 18, 2022
  • Critical 9.8
    CVE-2021-35587 Exploited Public exploit Scanner template EPSS 96%

    Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…

    Oracle Access Manager
    KEV Nov 28, 2022
  • Critical 9.1
    CVE-2022-23131 Exploited Public exploit Scanner template EPSS 96%

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to esca…

    Zabbix Frontend
    KEV Feb 22, 2022
  • Critical 9.0
    CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV May 1, 2023
  • Critical 10.0
    CVE-2021-44228 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

    Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV Dec 10, 2021
  • Critical 9.8
    CVE-2021-20038 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…

    SonicWall SonicWall SMA100 Network devices
    KEV Jan 28, 2022