Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,435
- Last 24h
- 770
- Critical, 7 days
- 374
- Known exploited
- 1,779
26,232 results · Clear filters · Feed
-
Critical 9.8
Microsoft Standard XPS Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows RNDIS Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Direct Show Remote Code Execution Vulnerability
Out-of-bounds read in Windows Direct Show allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Windows PDF Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Event Logging Service Remote Code Execution Vulnerability
Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.6
Visual Studio Code Security Feature Bypass Vulnerability
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
-
Critical 9.6
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.0
Microsoft SQL Server Remote Code Execution Vulnerability
Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
Critical 9.0
Microsoft SQL Server Remote Code Execution Vulnerability
Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Graphics Component Remote Code Execution Vulnerability
Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Message Queuing Remote Code Execution Vulnerability
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Netlogon Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows DHCP Server Remote Code Execution Vulnerability
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
Microsoft Exchange Server Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Critical 9.3
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.8
Windows DNS Server Remote Code Execution Vulnerability
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
RPC Runtime Library Remote Code Execution Vulnerability
Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Compressed Folder Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows NTFS Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Telnet Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft DirectMusic Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.9
Entra ID Elevation of Privilege Vulnerability
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
-
Critical 9.6
DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection o…
-
Critical 9.1
Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the s…
-
Critical 9.1
Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is aut…
-
Critical 9.9
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t…
-
Critical 9.9
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t…
-
Critical 9.9
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t…
-
Critical 9.9
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticate…
-
Critical 9.8
Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a v…
-
Critical 9.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthentica…
-
Critical 9.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthentica…