Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,414
- Last 24h
- 637
- Critical, 7 days
- 336
- Known exploited
- 1,779
26,127 results · Clear filters · Feed
-
Critical 9.9
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
Aspire Security Feature Bypass Vulnerability
Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
-
Critical 9.8
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
-
Critical 9.6
Visual Studio Code Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Search Remote Code Execution Vulnerability
Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Azure OpenAI Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft Graph Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
Azure Managed Grafana Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.0
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
Windows Kerberos Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.0
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
Windows Xbox Live Networking Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Color Management Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
-
Critical 9.0
Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability
Use after free in Windows Virtual Filtering Platform (VFP) allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DHCP Server Remote Code Execution Vulnerability
Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows iSCSI Remote Code Execution Vulnerability
Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Color Management Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft DirectMusic Remote Code Execution Vulnerability
Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft DirectMusic Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DNS Remote Code Execution Vulnerability
Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
-
Critical 9.0
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
-
Critical 9.9
Azure DevOps Server Remote Code Execution Vulnerability
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Xbox Remote Code Execution Vulnerability
Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.
-
Critical 9.4
Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Do…
-
Critical 9.2
Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0:…
-
Critical 9.3
Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) w…
-
Critical 9.6
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging soci…
-
Critical 9.4
GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is pa…
-
Critical 9.8
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in …
-
Critical 9.4
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to a…
-
Critical 9.6
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of p…
-
Critical 9.8
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker t…
-
Critical 9.1
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
-
Critical 9.1CVE-2026-125757 Public exploit
mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with a…
-
Critical 9.6
Sandbox escape due to use-after-free in the DOM: Service Workers component
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Critical 9.6
Sandbox escape due to use-after-free in the Widget: Gtk component
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Critical 9.6
Sandbox escape due to use-after-free in the IPC component
Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Critical 9.6
Sandbox escape due to use-after-free in the DOM: Service Workers component
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.