Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
409,774
Last 24h
333
Critical, 7 days
345
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

639 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-10148 Exploited Public exploit Scanner template EPSS 92%

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …

    SolarWinds Orion Platform
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-29583 Exploited Public exploit Scanner template EPSS 90%

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-29574 Exploited · Ransomware

    An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to ex…

    KEV Feb 6, 2025
  • Critical 9.8
    CVE-2020-17530 Exploited Public exploit Scanner template EPSS 96%

    Remote code execution in Apache Struts

    Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2020-4006 Exploited EPSS 17%

    VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit Scanner template EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.6
    CVE-2020-16010 Exploited

    Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had comprom…

    Google Chrome Browsers
    KEV Nov 3, 2021
  • Critical 9.6
    CVE-2020-15999 Exploited Public exploit EPSS 64%

    Heap buffer overflow in CefSharp

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium-browser firefox-esr Browsers Debian Ubuntu Azure Linux Alpine NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14750 Exploited Public exploit Scanner template EPSS 99%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-19949 Exploited · Ransomware EPSS 30%

    If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has alr…

    QNAP Systems QTS
    KEV May 24, 2022
  • Critical 9.8
    CVE-2020-14882 Exploited Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-14871 Exploited Public exploit EPSS 80%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported v…

    Oracle Solaris Operating System
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3992 Exploited · Ransomware Public exploit EPSS 83%

    OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5135 Exploited · Ransomware EPSS 27%

    A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially ex…

    SonicWall SonicOS Network devices
    KEV Mar 15, 2022
  • Critical 9.8
    CVE-2020-26919 Exploited Scanner template EPSS 57%

    NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-25223 Exploited Public exploit Scanner template EPSS 97%

    A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511…

    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2020-25213 Exploited Public exploit Scanner template EPSS 97%

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitr…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-17463 Exploited Scanner template EPSS 90%

    FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

    KEV Dec 10, 2021
  • Critical 9.8
    CVE-2020-17496 Exploited Public exploit Scanner template EPSS 87%

    vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14644 Exploited Public exploit Scanner template EPSS 95%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
    KEV Sep 18, 2024
  • Critical 10.0
    CVE-2020-1350 Exploited Public exploit EPSS 97%

    A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle re…

    Microsoft Windows Server, version 1903 (Server Core installation) Windows Server, version 1909 (Server Core installation) Windows Server Windows
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2020-1040 Exploited

    A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…

    Microsoft Windows Server Windows
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-6287 Exploited Public exploit Scanner template EPSS 95%

    SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …

    SAP SAP NetWeaver AS JAVA (LM Configuration Wizard)
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10987 Exploited Public exploit Scanner template EPSS 80%

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-15505 Exploited Public exploit Scanner template EPSS 100%

    A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5902 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-15415 Exploited Scanner template EPSS 84%

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remot…

    KEV Sep 30, 2024
  • Critical 9.8
    CVE-2020-15069 Exploited EPSS 11%

    Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks …

    KEV Feb 6, 2025
  • Critical 10.0
    CVE-2020-2021 Exploited · Ransomware Public exploit

    PAN-OS: Authentication Bypass in SAML Authentication

    When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-base…

    Palo Alto Networks PAN-OS Network devices
    KEV Mar 25, 2022
  • Critical 9.1
    CVE-2020-8816 Exploited Public exploit EPSS 78%

    Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static …

    KEV Dec 10, 2021
  • Critical 9.1
    CVE-2020-4428 Exploited Public exploit EPSS 62%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary c…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2020-4427 Exploited Public exploit Scanner template EPSS 70%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-12641 Exploited Public exploit Scanner template EPSS 84%

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Critical 9.8
    CVE-2020-11651 Exploited Public exploit EPSS 97%

    SaltStack Salt Unauthenticated Remote Code Execution

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-12271 Exploited · Ransomware EPSS 43%

    A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3161 Exploited Public exploit EPSS 84%

    Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability

    A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to…

    Cisco Cisco IP phone Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-2883 Exploited Public exploit Scanner template EPSS 95%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
    KEV Jan 7, 2025
  • Critical 9.8
    CVE-2020-3952 Exploited Public exploit Scanner template EPSS 90%

    Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Serv…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5722 Exploited Public exploit Scanner template EPSS 84%

    The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via craft…

    KEV Jan 28, 2022