Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,349
- Last 24h
- 675
- Critical, 7 days
- 356
- Known exploited
- 1,779
35,521 results · Clear filters · Feed
-
Critical 9.3CVE-2025-32965 Public exploit
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also…
-
Critical 9.3
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Executi…
KEV May 2, 2025 -
High 8.1CVE-2025-2594 Public exploit
User Registration & Membership < 4.1.3 - Authentication Bypass
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target accou…
-
High 8.8CVE-2025-3616 Public exploit
Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authentica…
-
High 7.8CVE-2025-1731 Public exploit
An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware…
-
Medium 4.3CVE-2025-3855 Public exploit
CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection
A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php/team_members/save_profile_image/ of the component Profile Picture Handler. T…
-
High 7.3CVE-2024-40445 Public exploit
A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read…
-
Medium 6.1CVE-2025-26159 Public exploit
Laravel Starter Cross Site Scripting (XSS)
Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.
-
Critical 9.8CVE-2025-32958 Public exploit
Adept exposed the GITHUB_TOKEN in workflow run artifact
Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automati…
-
High 8.8CVE-2024-57394 Public exploit
The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore…
-
Medium 6.1CVE-2025-28121 Public exploit
code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" …
-
Medium 5.3CVE-2025-43921 Public exploit
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/c…
-
Medium 4.1CVE-2025-43929 Public exploit
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that m…
-
Medium 5.4CVE-2025-43920 Public exploit
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated…
-
Medium 5.8CVE-2025-43919 Public exploit
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ di…
-
Critical 9.3CVE-2025-32434 Public exploit
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading…
-
Critical 9.2CVE-2025-2492 Public exploit
An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted re…
-
Critical 9.8CVE-2024-53591 Public exploit
An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.
-
Medium 4.7CVE-2025-28355 Public exploit
Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to exec…
-
High 7.1CVE-2025-24752 Public exploit
WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n…
-
Critical 9.9
WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Post: from n/a through <= 2.4.0.
-
Critical 9.9CVE-2025-32682 Public exploit
WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.
-
Critical 9.8CVE-2025-39596 Public exploit
WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerability
Weak Authentication vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows Privilege Escalation.This issue affects Quentn WP: from n/a through <= 1.2.8.
-
Critical 9.1CVE-2025-39436 Public exploit
WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <= 1.0.
-
High 8.4CVE-2024-55211 Public exploit
An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.
-
Critical 9.8CVE-2024-53924 Public exploit
Pycel allows code injection via a crafted formula
Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.
-
Critical 9.8CVE-2025-28009 Public exploit
A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.…
-
Medium 6.1CVE-2025-29015 Public exploit
Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/p…
-
Medium 6.3CVE-2025-29722 Public exploit
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authentica…
-
Critical 10.0
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protoc…
KEV Jun 9, 2025 -
Critical 9.8
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.…
KEV Apr 17, 2025 -
Medium 5.5CVE-2025-23134 Public exploit
ALSA: timer: Don't take register_mutex with copy_from/to_user()
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Don't take register_mutex with copy_from/to_user() The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they mig…
-
Medium 6.6CVE-2025-39538 Public exploit
WordPress WP-Advanced-Search plugin <= 3.3.9.4 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Server.This issue affects WP-Advanced-Search: from n/a through <= 3.3.9.4.
-
Critical 9.6CVE-2025-39601 Public exploit
WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.
-
Medium 5.4CVE-2025-26153 Public exploit
A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious…
-
Critical 9.6CVE-2025-30967 Public exploit
WordPress WPJobBoard plugin < 5.11.1 - CSRF to Remote Code Execution (RCE) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a through n/a.
-
High 8.1CVE-2025-30712 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 6.5CVE-2025-21574 Public exploit
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…
-
Critical 9.3
Web-Check allows command Injection via Unvalidated URL in Screenshot API
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shel…
-
Medium 6.7CVE-2025-1122 Public exploit
Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker wi…