Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
409,413
Last 24h
637
Critical, 7 days
337
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

472 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-29583 Exploited Public exploit Scanner template EPSS 90%

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-17530 Exploited Public exploit Scanner template EPSS 96%

    Remote code execution in Apache Struts

    Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit Scanner template EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.6
    CVE-2020-15999 Exploited Public exploit EPSS 64%

    Heap buffer overflow in CefSharp

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium-browser firefox-esr Browsers Debian Ubuntu Azure Linux Alpine NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14750 Exploited Public exploit Scanner template EPSS 99%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14882 Exploited Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-14871 Exploited Public exploit EPSS 80%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported v…

    Oracle Solaris Operating System
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3992 Exploited · Ransomware Public exploit EPSS 83%

    OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-25223 Exploited Public exploit Scanner template EPSS 97%

    A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511…

    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2020-25213 Exploited Public exploit Scanner template EPSS 97%

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitr…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-17496 Exploited Public exploit Scanner template EPSS 87%

    vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14644 Exploited Public exploit Scanner template EPSS 95%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
    KEV Sep 18, 2024
  • Critical 10.0
    CVE-2020-1350 Exploited Public exploit EPSS 97%

    A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle re…

    Microsoft Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server Windows
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-6287 Exploited Public exploit Scanner template EPSS 95%

    SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …

    SAP SAP NetWeaver AS JAVA (LM Configuration Wizard)
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10987 Exploited Public exploit Scanner template EPSS 80%

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-15505 Exploited Public exploit Scanner template EPSS 100%

    A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5902 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic…

    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-2021 Exploited · Ransomware Public exploit

    PAN-OS: Authentication Bypass in SAML Authentication

    When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-base…

    Palo Alto Networks PAN-OS Network devices
    KEV Mar 25, 2022
  • Critical 9.1
    CVE-2020-8816 Exploited Public exploit EPSS 78%

    Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static …

    KEV Dec 10, 2021
  • Critical 9.1
    CVE-2020-4428 Exploited Public exploit EPSS 62%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary c…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2020-4427 Exploited Public exploit Scanner template EPSS 70%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-12641 Exploited Public exploit Scanner template EPSS 84%

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Critical 9.8
    CVE-2020-11651 Exploited Public exploit EPSS 97%

    SaltStack Salt Unauthenticated Remote Code Execution

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3161 Exploited Public exploit EPSS 84%

    Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability

    A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to…

    Cisco Cisco IP phone Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-2883 Exploited Public exploit Scanner template EPSS 95%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
    KEV Jan 7, 2025
  • Critical 9.8
    CVE-2020-3952 Exploited Public exploit Scanner template EPSS 90%

    Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Serv…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5722 Exploited Public exploit Scanner template EPSS 84%

    The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via craft…

    KEV Jan 28, 2022
  • Critical 9.8
    CVE-2020-7961 Exploited Public exploit Scanner template EPSS 100%

    Deserialization of Untrusted Data in Liferay Portal

    Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

    com.liferay.portal:com.liferay.portal.kernel Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5847 Exploited Public exploit Scanner template EPSS 96%

    Unraid through 6.8.0 allows Remote Code Execution.

    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-0796 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Feb 10, 2022
  • Critical 10.0
    CVE-2020-6207 Exploited Public exploit Scanner template EPSS 98%

    SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform a…

    SAP SAP Solution Manager (User Experience Monitoring)
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10189 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-9054 Exploited Public exploit Scanner template EPSS 100%

    ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS de…

    Zyxel NSA210 NSA221 NSA320 Network devices
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

    Improper Privilege Management in Tomcat

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

    Apache Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2020-0618 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles pag…

    Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) Microsoft SQL Server Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)
    KEV Sep 18, 2024
  • Critical 9.8
    CVE-2020-8657 Exploited Public exploit Scanner template EPSS 92%

    An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in includ…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-8644 Exploited Public exploit Scanner template EPSS 86%

    PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-8515 Exploited Public exploit Scanner template EPSS 100%

    DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allo…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-7247 Exploited Public exploit Scanner template EPSS 99%

    smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…

    opensmtpd opensmtpd opensmtpd Debian Ubuntu Alpine
    KEV Mar 25, 2022