35,538 results · Clear filters · Feed
-
Unscored —CVE-2022-26269 Public exploit
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages.
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Pri…
-
Unscored —CVE-2022-23884 Public exploit
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by Pur…
-
Critical 9.8
SQL Injection in ImpressCMS
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
-
Unscored —
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to…
-
Unscored —CVE-2021-40906 Public exploit
CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is i…
-
High 8.8CVE-2021-40905 Public exploit
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the upl…
-
Unscored —CVE-2021-40904 Public exploit
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Do…
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
Medium 6.1
Cross-site Scripting in Keycloak
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
-
Critical 9.8
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…
KEV Mar 31, 2022 -
High 7.5
Nokogiri affected by zlib's Out-of-bounds Write vulnerability
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
-
Unscored —
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with…
-
Unscored —CVE-2022-26629 Public exploit
An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function du…
-
Unscored —CVE-2020-20093 Public exploit
The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properl…
-
Unscored —
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER …
-
Unscored —CVE-2022-27254 Public exploit
The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allow…
-
Critical 10.0CVE-2021-27460 Public exploit
Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthentica…
-
Unscored —CVE-2022-27666 Public exploit
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This fla…
-
Unscored —CVE-2021-43650 Public exploit
WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
-
Unscored —
BookingPress < 1.0.11 - Unauthenticated SQL Injection
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), lead…
-
Unscored —
Formcraft3 < 3.8.28 - Unauthenticated SSRF
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
-
Unscored —CVE-2022-24125 Public exploit
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send a…
-
Unscored —
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry i…
-
Critical 9.8
Remote Code Execution in Contao Managed Edition
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
-
Unscored —CVE-2022-25581 Public exploit
Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allo…
-
Unscored —CVE-2022-22639 Public exploit
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Mont…
-
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS…
KEV Feb 11, 2022 -
Unscored —CVE-2022-22600 Public exploit
The issue was addressed with improved permissions logic. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, ma…
-
Unscored —
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remo…
-
Unscored —CVE-2022-1011 Public exploit
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…
-
Critical 9.8
Improper Privilege Management in Open Web Analytics
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intend…
-
Unscored —CVE-2022-25949 Public exploit
The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle cra…
-
Unscored —CVE-2022-26503 Public exploit
Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to r…
-
Critical 9.8CVE-2021-44906 Public exploit
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
-
Critical 9.8CVE-2022-23812 Public exploit
Malicious Package
This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of h…
-
Unscored —CVE-2022-0918 Public exploit
A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access …
-
Unscored —CVE-2021-39706 Public exploit
In onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials storage due to a missi…
-
Unscored —CVE-2021-39704 Public exploit
In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service…
-
Unscored —CVE-2021-39692 Public exploit
In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to …