Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,165
- Last 24h
- 698
- Critical, 7 days
- 369
- Known exploited
- 1,779
26,207 results · Clear filters · Feed
-
Critical 9.6
Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
Critical 9.6
Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cro…
-
Critical 9.6
Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sen…
-
Critical 9.6
Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromise…
-
Critical 9.6
Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engi…
-
Critical 9.6
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging soc…
-
Critical 9.6
Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromise…
-
Critical 9.6
Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system…
-
Critical 9.6
Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypa…
-
Critical 9.6
Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging soc…
-
Critical 9.6
Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web o…
-
Critical 9.6
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveragi…
-
Critical 9.6
Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveragin…
-
Critical 9.6
Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin…
-
Critical 9.6
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised…
-
Critical 9.6
Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cr…
-
Critical 9.6
Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a loc…
-
Critical 9.6
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
Critical 9.6
Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had comp…
-
Critical 9.6
Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveragin…
-
Critical 9.6
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary co…
-
Critical 9.6
Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin poli…
-
Critical 9.6
Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code insi…
-
Critical 9.6
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had…
-
Critical 9.6
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code insid…
-
Critical 9.1
@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router ser…
-
Critical 9.1
Authorization: Negotiate sent to foreign origin
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…
-
Critical 9.1
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (versio…
-
Critical 9.1
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(…
-
Critical 9.1
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOT…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (ver…
-
Critical 9.1
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s)…
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X20…
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X20…
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functi…
-
Critical 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality …
-
Critical 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality …
-
Critical 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functi…