4,286 results · Clear filters · Feed
-
High 8.8
In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improv…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 8.8
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML …
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft …
KEV Mar 15, 2022 -
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 8.8
Archive_Tar contains Potential RCE if filename starts with phar://
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…
-
High 7.8
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
High 7.5CVE-2018-1000850 Public exploit
Directory Traversal vulnerability in Square Retrofit
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources othe…
-
High 7.1
IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) …
-
High 8.4
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Mar 3, 2025 -
High 7.8
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka …
KEV May 24, 2022 -
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.8CVE-2018-6756 Public exploit
True Key (TK) Windows Client - Authentication Abuse vulnerability
Authentication Abuse vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute unauthorized commands via specially crafted malware.
-
High 7.5CVE-2018-6757 Public exploit
True Key (TK) Windows Client - Privilege Escalation vulnerability
Privilege Escalation vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.
-
High 7.2CVE-2018-6755 Public exploit
True Key (TK) Windows Client - Weak Directory Permission Vulnerability
Weak Directory Permission Vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.
-
High 7.5
Unauthenticated File Read in PHP Proxy
In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.
-
High 7.2
Subrion CMS RCE Vulnerability
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.
-
High 8.8
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbi…
KEV Jun 8, 2022 -
High 8.8
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google C…
KEV Jun 8, 2022 -
High 8.8CVE-2018-19277 Public exploit
XXE in PHPSpreadsheet due to encoding issue
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
-
High 7.4
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation o…
KEV Mar 3, 2022 -
High 7.5
LFI in PHP-Proxy 5.1.0
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default …
-
High 7.8CVE-2018-15687 Public exploit
systemd: chown_one() can dereference symlinks
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
-
High 7.0CVE-2018-15686 Public exploit
systemd: reexec state injection: fgets() on overlong lines leads to line splitting
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected relea…
-
High 7.8
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability
A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied paramet…
-
High 7.2
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Versio…
-
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Jan 21, 2022 -
High 7.5CVE-2018-18074 Public exploit
Insufficiently Protected Credentials in Requests
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
-
High 7.8
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with …
KEV Jan 26, 2026 -
High 7.5CVE-2018-17297 Public exploit
Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
-
High 7.5CVE-2018-11761 Public exploit
High severity vulnerability that affects org.apache.tika:tika-core
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
-
High 7.5
High severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua
Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.
-
High 7.8
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (…
KEV Mar 28, 2022 -
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique…
-
High 7.5
Denial of service in ASP.NET Core
A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." This affects Microsoft.Data.OData.
-
High 7.5
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker c…
-
High 8.1CVE-2018-10936 Public exploit
Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker coul…