Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,774
- Last 24h
- 336
- Critical, 7 days
- 345
- Known exploited
- 1,779
639 results · Clear filters · Feed
-
Critical 9.8
Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be …
KEV Nov 3, 2021 -
Critical 9.8
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dn…
KEV Mar 5, 2024 -
Critical 9.8
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Acc…
KEV Mar 28, 2022 -
Critical 9.8
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…
KEV Nov 3, 2021 -
Critical 9.0
Serv-U Remote Memory Escape Vulnerability
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…
KEV Nov 3, 2021 -
Critical 9.0
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Critical 10.0
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.…
KEV Nov 3, 2021 -
Critical 9.8
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote …
KEV Apr 11, 2022 -
Critical 9.8
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…
KEV Nov 3, 2021 -
Critical 10.0
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.…
KEV Mar 31, 2022 -
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
KEV Apr 6, 2022 -
Critical 9.8
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerabil…
KEV Nov 3, 2021 -
Critical 9.8
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630…
KEV Jun 2, 2025 -
Critical 9.8
Cisco HyperFlex HX Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…
KEV Nov 3, 2021 -
Critical 9.8
Cisco HyperFlex HX Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…
KEV Nov 3, 2021 -
Critical 9.8
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3…
KEV Nov 3, 2021 -
Critical 10.0
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…
KEV Nov 3, 2021 -
Critical 10.0
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…
KEV Nov 3, 2021 -
Critical 9.8
Command Injection Vulnerability in QTS and QuTS hero
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: …
KEV Apr 11, 2022 -
Critical 9.8
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…
KEV Nov 3, 2021 -
Critical 9.8CVE-2021-1871 Exploited
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…
KEV Nov 3, 2021 -
Critical 9.8CVE-2021-1870 Exploited
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…
KEV Nov 3, 2021 -
Critical 9.8
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious acto…
KEV Jan 18, 2022 -
Critical 9.8
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…
KEV Jan 18, 2022 -
Critical 9.8
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…
KEV Nov 3, 2021 -
Critical 9.8
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…
KEV Mar 5, 2026 -
Critical 9.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Critical 9.8
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor…
KEV Nov 3, 2021 -
Critical 9.8
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endp…
KEV Nov 3, 2021 -
Critical 9.8CVE-2021-27103 Exploited · Ransomware
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed ver…
KEV Nov 3, 2021 -
Critical 9.8
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…
KEV Nov 3, 2021 -
Critical 9.8
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Th…
KEV Nov 3, 2021 -
Critical 9.8
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perfor…
KEV Nov 3, 2021 -
Critical 9.8
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead…
KEV Nov 3, 2021 -
Critical 9.8
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web inte…
KEV Nov 3, 2021 -
Critical 9.8
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JW…
KEV Oct 8, 2026 -
Critical 9.8
Unauthenticated remote code execution in Ignition
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Larave…
KEV Sep 18, 2023 -
Critical 9.6CVE-2020-16017 Exploited
Use after free in CefSharp
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
KEV Nov 3, 2021 -
Critical 9.1
Apache Flink directory traversal attack: reading remote files through the REST API
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible b…
KEV May 23, 2024