Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,248
- Last 24h
- 667
- Critical, 7 days
- 366
- Known exploited
- 1,779
639 results · Clear filters · Feed
-
Critical 9.8
Spring Data Commons remote code injection vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can sup…
KEV Mar 25, 2022 -
Critical 9.8
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
KEV Nov 3, 2021 -
Critical 9.8
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow a…
KEV Mar 3, 2022 -
Critical 9.8
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remo…
KEV Sep 8, 2022 -
Critical 9.8
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 c…
KEV Mar 25, 2022 -
Critical 9.8
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH…
KEV Sep 8, 2022 -
Critical 9.8
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…
KEV Nov 3, 2021 -
Critical 9.8
A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers…
KEV Mar 25, 2022 -
Critical 9.8
Deserialization of Untrusted Data in Jenkins
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the…
KEV Oct 2, 2025 -
Critical 9.8
Inadequate Encryption Strength
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
KEV Jan 10, 2022 -
Critical 9.8
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote…
KEV Aug 18, 2022 -
Critical 9.8
Deserialization of Untrusted Data in Apache commons collections
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …
-
Critical 9.8
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter…
KEV Dec 10, 2021 -
Critical 9.8
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could a…
KEV Mar 3, 2022 -
Critical 9.8
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_add…
KEV Mar 25, 2022 -
Critical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…
KEV Apr 11, 2022 -
Critical 9.8
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …
KEV Jan 26, 2023 -
Critical 9.8
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as …
KEV Mar 25, 2022 -
Critical 9.8
Code execution in Apache Struts 1 plugin
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
KEV Feb 10, 2022 -
Critical 9.8
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…
KEV Nov 3, 2021 -
Critical 9.8
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., ex…
KEV Feb 15, 2022 -
Critical 9.8
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 200…
KEV May 24, 2022 -
Critical 9.8
SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on th…
KEV Oct 14, 2025 -
Critical 9.8
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, all…
KEV Mar 30, 2023 -
Critical 9.8
NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 all…
KEV Jun 8, 2022 -
Critical 9.8
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 1…
KEV Mar 5, 2026 -
Critical 9.8
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Man…
KEV Jan 28, 2022 -
Critical 9.8
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier ha…
KEV Feb 24, 2025 -
Critical 9.8
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgea…
KEV Mar 25, 2022 -
Critical 9.8
Apache Tomcat Improper Access Control vulnerability
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…
KEV May 12, 2023 -
Critical 9.8
fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory w…
KEV Jul 7, 2025 -
Critical 9.8
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 i…
KEV Nov 3, 2021 -
Critical 9.8
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software c…
KEV Mar 25, 2022 -
Critical 9.8
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …
KEV Nov 3, 2021 -
Critical 9.8
ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitr…
KEV Mar 7, 2022 -
Critical 9.8
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.c…
KEV Mar 25, 2022 -
Critical 9.8
Remote code execution in PHPMailer
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
KEV Jul 7, 2025 -
Critical 9.8
Improper Access Control in Apache Shiro
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
KEV Nov 3, 2021 -
Critical 9.8
Improper Input Validation in Apache ActiveMQ
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
KEV Feb 10, 2022 -
Critical 10.0
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentic…
KEV Nov 3, 2021