Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
409,728
Last 24h
377
Critical, 7 days
343
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

639 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-31199 Exploited · Ransomware Public exploit EPSS 36%

    Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…

    KEV Jul 11, 2023
  • Critical 9.8
    CVE-2016-20017 Exploited Public exploit EPSS 66%

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…

    KEV Jan 8, 2024
  • Critical 9.8
    CVE-2022-40684 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

    Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Network devices
    KEV Oct 11, 2022
  • Critical 9.8
    CVE-2022-21587 Exploited · Ransomware Public exploit Scanner template EPSS 98%

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

    Oracle Web Applications Desktop Integrator
    KEV Feb 2, 2023
  • Critical 9.6
    CVE-2022-3075 Exploited

    Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had comprom…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Sep 8, 2022
  • Critical 9.8
    CVE-2022-41352 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

    KEV Oct 20, 2022
  • Critical 9.8
    CVE-2022-3236 Exploited Scanner template EPSS 99%

    A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firew…

    Sophos Sophos Firewall Network devices
    KEV Sep 23, 2022
  • Critical 9.8
    CVE-2022-35914 Exploited Public exploit Scanner template EPSS 100%

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    KEV Mar 7, 2023
  • Critical 10.0
    CVE-2022-27593 Exploited · Ransomware Scanner template EPSS 88%

    DeadBolt Ransomware

    An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QT…

    QNAP Systems Photo Station
    KEV Sep 8, 2022
  • Critical 9.8
    CVE-2022-37055 Exploited EPSS 56%

    D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, …

    KEV Dec 8, 2025
  • Critical 9.8
    CVE-2022-37042 Exploited · Ransomware Public exploit Scanner template EPSS 92%

    Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts f…

    KEV Aug 11, 2022
  • Critical 9.8
    CVE-2022-26138 Exploited Public exploit Scanner template EPSS 98%

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…

    Atlassian Questions For Confluence Web / CMS
    KEV Jul 29, 2022
  • Critical 9.8
    CVE-2022-35405 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…

    KEV Sep 22, 2022
  • Critical 9.8
    CVE-2022-26352 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form re…

    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-26134 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Jun 2, 2022
  • Critical 9.8
    CVE-2022-29303 Exploited Public exploit Scanner template EPSS 98%

    SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

    KEV Jul 13, 2023
  • Critical 9.8
    CVE-2022-30525 Exploited Public exploit Scanner template EPSS 100%

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…

    Zyxel ATP series firmware VPN series Firmware USG FLEX 50(W) firmware Network devices
    KEV May 16, 2022
  • Critical 9.8
    CVE-2022-30333 Exploited · Ransomware Public exploit EPSS 99%

    RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …

    unrar-nonfree unrar-nonfree rar libclamunrar Debian Ubuntu
    KEV Aug 9, 2022
  • Critical 9.8
    CVE-2022-1388 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

    F5 BIG-IP Network devices
    KEV May 10, 2022
  • Critical 9.8
    CVE-2022-29499 Exploited · Ransomware EPSS 55%

    The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incor…

    KEV Jun 27, 2022
  • Critical 9.8
    CVE-2022-24706 Exploited Public exploit Scanner template EPSS 93%

    Remote Code Execution Vulnerability in Packaging

    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including re…

    Apache Software Foundation Apache CouchDB
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-27924 Exploited · Ransomware Scanner template EPSS 94%

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands …

    KEV Aug 4, 2022
  • Critical 9.8
    CVE-2022-21445 Exploited Public exploit EPSS 62%

    Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…

    Oracle Application Development Framework (ADF)
    KEV Sep 18, 2024
  • Critical 9.8
    CVE-2022-29464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fil…

    KEV Apr 25, 2022
  • Critical 10.0
    CVE-2022-24816 Exploited Public exploit Scanner template EPSS 100%

    Improper Control of Generation of Code in jai-ext

    JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and …

    geosolutions-it jai-ext it.geosolutions.jaiext.jiffle:jt-jiffle it.geosolutions.jaiext.jiffle:jt-jiffle-language Maven
    KEV Jun 26, 2024
  • Critical 9.8
    CVE-2022-22954 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templ…

    KEV Apr 14, 2022
  • Critical 9.8
    CVE-2022-22965 Exploited Public exploit Scanner template EPSS 100%

    Remote Code Execution in Spring Framework

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

    libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
    KEV Apr 4, 2022
  • Critical 9.8
    CVE-2022-22963 Exploited Public exploit Scanner template EPSS 100%

    Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …

    org.springframework.cloud:spring-cloud-function-context Maven
    KEV Aug 25, 2022
  • Critical 9.8
    CVE-2022-26871 Exploited EPSS 19%

    An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to up…

    Trend Micro Trend Micro Apex Central
    KEV Mar 31, 2022
  • Critical 9.8
    CVE-2022-26258 Exploited EPSS 92%

    D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set…

    KEV Sep 8, 2022
  • Critical 9.8
    CVE-2022-1040 Exploited Public exploit Scanner template EPSS 100%

    An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…

    Sophos Sophos Firewall Network devices
    KEV Mar 31, 2022
  • Critical 9.8
    CVE-2022-22587 Exploited EPSS 12%

    A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3…

    Apple macOS iOS and iPadOS macOS iOS
    KEV Jan 28, 2022
  • Critical 9.8
    CVE-2022-26501 Exploited · Ransomware

    Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

    KEV Dec 13, 2022
  • Critical 9.8
    CVE-2022-26143 Exploited Scanner template EPSS 87%

    The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allow…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2022-26318 Exploited Public exploit EPSS 78%

    On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulne…

    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2022-22947 Exploited Public exploit Scanner template EPSS 98%

    Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could al…

    org.springframework.cloud:spring-cloud-gateway Maven
    KEV May 16, 2022
  • Critical 10.0
    CVE-2022-0543 Exploited Public exploit Scanner template EPSS 99%

    It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specifi…

    Debian redis redis redis Debian Ubuntu
    KEV Mar 28, 2022
  • Critical 9.8
    CVE-2021-45382 Exploited Scanner template EPSS 98%

    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826…

    KEV Apr 4, 2022
  • Critical 9.8
    CVE-2022-24086 Exploited Public exploit Scanner template EPSS 99%

    Adobe Commerce checkout improper input validation leads to remote code execution

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code e…

    Adobe Magento Commerce magento/community-edition Web / CMS Packagist
    KEV Feb 15, 2022
  • Critical 9.8
    CVE-2022-24112 Exploited Public exploit Scanner template EPSS 96%

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…

    Apache Software Foundation Apache APISIX
    KEV Aug 25, 2022