Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,241
- Last 24h
- 581
- Critical, 7 days
- 356
- Known exploited
- 1,779
35,501 results · Clear filters · Feed
-
High 8.7CVE-2013-10035 Public exploit
ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution
A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cas…
-
Critical 10.0CVE-2014-125124 Public exploit
Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection
An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter a…
-
High 8.6CVE-2011-10008 Public exploit
MPlayer Lite r33064 M3U Stack-Based Buffer Overflow
A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http:// URL entries. An attacker can craft a malicious .m3u file with a specially formatted URL that tri…
-
Medium 5.3CVE-2014-125122 Public exploit
Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset
A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint…
-
Critical 10.0CVE-2014-125123 Public exploit
Kloxo < 6.1.12 Unauthenticated SQL Injection RCE
An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel (developed by LXCenter) prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, a…
-
Critical 9.3CVE-2013-10033 Public exploit
Kimai 0.9.2 db_restore.php SQL Injection
An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates[] POST parameter, enabling file write via INTO OUTFILE under specific envi…
-
Critical 9.3CVE-2013-10034 Public exploit
Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE
An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. …
-
High 8.7CVE-2013-10039 Public exploit
GestioIP 3.0 ip_checkhost.cgi RCE
A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication…
-
Critical 9.3CVE-2013-10042 Public exploit
freeFTPd <= 1.0.10 PASS Command Stack-Based Buffer Overflow
A stack-based buffer overflow vulnerability exists in freeFTPd version 1.0.10 and earlier in the handling of the FTP PASS command. When an attacker sends a specially crafted password string, the application fails to validate input length, resulting in memory …
-
Critical 9.3CVE-2013-10038 Public exploit
FlashChat Arbitrary File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploa…
-
Critical 9.3CVE-2012-10021 Public exploit
D-Link DIR-605L Captcha Handling Buffer Overflow
A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the …
-
Critical 10.0CVE-2013-10040 Public exploit
ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE
ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once up…
-
High 8.4CVE-2013-10036 Public exploit
Beetel Connection Manager NetConfig.ini Stack-Based Buffer Overflow
A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04 when parsing the UserName parameter in the NetConfig.ini configuration file. A crafted .ini file containing an overly long UserName value can overwrite…
-
Critical 9.5CVE-2013-10043 Public exploit
Astium VOIP PBX <= 2.1 SQL Injection File Upload RCE
A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can up…
-
Critical 10.0CVE-2014-125121 Public exploit
Array Networks vAPV and vxAG Default Credential Privilege Escalation
Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devi…
-
High 8.8CVE-2014-125125 Public exploit
A10 Networks AX Loadbalancer Path Traversal
A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. A…
-
Medium 6.3CVE-2025-54589 Public exploit
copyparty Reflected XSS via Filter Parameter
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value direc…
-
High 7.2CVE-2025-46359 Public exploit
A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator m…
-
High 8.8CVE-2025-53558 Public exploit
ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge …
-
High 8.8CVE-2025-7847 Public exploit
AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level acces…
-
Medium 6.3CVE-2024-34328 Public exploit
An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL.
-
Medium 6.5CVE-2024-34327 Public exploit
Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the passwo…
-
Medium 6.1CVE-2025-50866 Public exploit
CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of …
-
Medium 6.5CVE-2025-50867 Public exploit
A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where t…
-
Medium 5.4CVE-2025-29557 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where use…
-
High 7.3CVE-2025-29556 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restriction…
-
High 8.0CVE-2025-52289 Public exploit
A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privile…
-
Low 3.5CVE-2025-51385 Public exploit
D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz_dlink_asp function via the id parameter.
-
Critical 9.8
SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint
A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from …
-
Critical 9.1CVE-2025-54430 Public exploit
dedupe is vulnerable to secret exfiltration via `issue_comment`
dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmar…
-
High 7.8CVE-2025-50777 Public exploit
The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Ac…
-
High 8.1CVE-2025-45620 Public exploit
An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request
-
Medium 6.5CVE-2025-45619 Public exploit
An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction…
-
High 8.8
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, ma…
KEV Mar 20, 2026 -
Critical 9.9
BentoML is Vulnerable to an SSRF Attack Through File Upload Processing
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force t…
-
Medium 6.4CVE-2024-43018 Public exploit
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters a…
-
Critical 9.8CVE-2025-50738 Public exploit
Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction be…
-
High 8.1CVE-2025-45346 Public exploit
Bacula-web SQL Injection Vulnerability
SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.
-
Critical 9.8CVE-2025-44136 Public exploit
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an …
-
High 8.2CVE-2025-44137 Public exploit
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is res…