Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,756
- Last 24h
- 372
- Critical, 7 days
- 344
- Known exploited
- 1,779
639 results · Clear filters · Feed
-
Critical 10.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0CVE-2022-20700 Exploited
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0CVE-2022-20701 Exploited
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0CVE-2022-20703 Exploited
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 9.8
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…
KEV Aug 18, 2022 -
Critical 9.1
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
KEV Dec 18, 2024 -
Critical 9.8
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…
KEV Nov 28, 2022 -
Critical 9.8
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused t…
KEV Dec 18, 2024 -
Critical 9.1
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to esca…
KEV Feb 22, 2022 -
Critical 9.0
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…
KEV May 1, 2023 -
Critical 9.8
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the serve…
KEV Dec 10, 2021 -
Critical 10.0
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …
KEV Dec 10, 2021 -
Critical 9.8
Arbitrary file upload vulnerability in FatPipe software
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identi…
KEV Jan 10, 2022 -
Critical 9.8
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…
KEV Jan 28, 2022 -
Critical 9.8
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execu…
KEV Mar 25, 2024 -
Critical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014…
KEV Dec 1, 2021 -
Critical 9.8
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
KEV Jun 22, 2023 -
Critical 10.0
GeoJSON URL validation can expose server files and environment variables to unauthorized users
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…
KEV Nov 12, 2024 -
Critical 9.8
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…
KEV Mar 25, 2022 -
Critical 9.8
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…
KEV Nov 3, 2021 -
Critical 9.8
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the rend…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised t…
KEV Nov 3, 2021 -
Critical 9.8
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…
KEV Nov 3, 2021 -
Critical 9.8
Snapshot authentication bypass in grafana
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If…
KEV Aug 25, 2022 -
Critical 9.8
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…
KEV Mar 25, 2022 -
Critical 9.8
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…
KEV Nov 3, 2021 -
Critical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation…
KEV Jan 10, 2022 -
Critical 9.0
mod_proxy SSRF
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
KEV Dec 1, 2021 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Critical 9.8
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Critical 9.9
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…
KEV Jun 9, 2022 -
Critical 9.8
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous…
KEV Jan 18, 2022 -
Critical 9.8
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…
KEV Nov 3, 2021 -
Critical 9.6
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …
KEV Nov 3, 2021 -
Critical 9.8
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs …
KEV Dec 1, 2021 -
Critical 9.8
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…
KEV Nov 3, 2021 -
Critical 9.8
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled a…
KEV Dec 10, 2021