Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
409,413
Last 24h
637
Critical, 7 days
337
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

472 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-44529 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execu…

    KEV Mar 25, 2024
  • Critical 9.8
    CVE-2021-44077 Exploited Public exploit Scanner template EPSS 94%

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014…

    KEV Dec 1, 2021
  • Critical 9.8
    CVE-2021-44026 Exploited Public exploit EPSS 70%

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Critical 10.0
    CVE-2021-41277 Exploited Public exploit Scanner template EPSS 97%

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…

    metabase metabase
    KEV Nov 12, 2024
  • Critical 9.8
    CVE-2021-42237 Exploited · Ransomware Public exploit Scanner template EPSS 98%

    Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2021-42258 Exploited · Ransomware Public exploit Scanner template EPSS 75%

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-42013 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-22941 Exploited · Ransomware Public exploit EPSS 54%

    Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2021-22005 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-36260 Exploited Public exploit Scanner template EPSS 100%

    A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation…

    KEV Jan 10, 2022
  • Critical 9.0
    CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    mod_proxy SSRF

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
    KEV Dec 1, 2021
  • Critical 9.8
    CVE-2021-33045 Exploited Public exploit Scanner template EPSS 100%

    The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…

    KEV Aug 21, 2024
  • Critical 9.8
    CVE-2021-33044 Exploited Public exploit Scanner template EPSS 100%

    The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…

    KEV Aug 21, 2024
  • Critical 9.8
    CVE-2021-38647 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    Microsoft Azure Stack Hub Open Management Infrastructure Log Analytics Agent
    KEV Nov 3, 2021
  • Critical 9.9
    CVE-2021-38163 Exploited Public exploit EPSS 37%

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…

    SAP SAP NetWeaver (Visual Composer 7.0 RT)
    KEV Jun 9, 2022
  • Critical 9.8
    CVE-2021-40870 Exploited Public exploit Scanner template EPSS 93%

    An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous…

    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2021-40539 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-26084 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-35464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…

    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2021-35211 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    Serv-U Remote Memory Escape Vulnerability

    Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…

    SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2021-34523 Exploited · Ransomware Public exploit EPSS 100%

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2021-34473 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21985 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-31166 Exploited Public exploit EPSS 100%

    HTTP Protocol Stack Remote Code Execution Vulnerability

    HTTP Protocol Stack Remote Code Execution Vulnerability

    Microsoft Windows 10 Version 20H2 Windows Server version 20H2 Windows 10 Version 2004 Windows
    KEV Apr 6, 2022
  • Critical 9.8
    CVE-2021-1498 Exploited Public exploit Scanner template EPSS 100%

    Cisco HyperFlex HX Command Injection Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

    Cisco Cisco HyperFlex HX Data Platform Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-1497 Exploited Public exploit Scanner template EPSS 100%

    Cisco HyperFlex HX Command Injection Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

    Cisco Cisco HyperFlex HX Data Platform Network devices
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2021-22205 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

    GitLab GitLab gitlab Web / CMS Ubuntu
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2021-22893 Exploited · Ransomware Public exploit EPSS 48%

    Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-2509 Exploited Public exploit EPSS 34%

    Command Injection Vulnerability in QTS and QuTS hero

    A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: …

    QNAP Systems QTS QuTS hero
    KEV Apr 11, 2022
  • Critical 9.8
    CVE-2021-20021 Exploited · Ransomware Public exploit Scanner template EPSS 89%

    A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

    SonicWall Email Security Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21975 Exploited · Ransomware Public exploit Scanner template EPSS 78%

    Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious acto…

    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2021-22986 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-22681 Exploited Public exploit EPSS 64%

    Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…

    KEV Mar 5, 2026
  • Critical 9.1
    CVE-2021-26855 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21972 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-27101 Exploited · Ransomware Public exploit

    Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-22502 Exploited Public exploit Scanner template EPSS 97%

    Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Th…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-3129 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Unauthenticated remote code execution in Ignition

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Larave…

    facade/ignition Packagist
    KEV Sep 18, 2023
  • Critical 9.1
    CVE-2020-17519 Exploited Public exploit Scanner template EPSS 98%

    Apache Flink directory traversal attack: reading remote files through the REST API

    A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible b…

    Apache Software Foundation Apache Flink org.apache.flink:flink-runtime_2.12 org.apache.flink:flink-runtime_2.11 Maven
    KEV May 23, 2024
  • Critical 9.8
    CVE-2020-10148 Exploited Public exploit Scanner template EPSS 92%

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …

    SolarWinds Orion Platform
    KEV Nov 3, 2021