Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,354
- Last 24h
- 665
- Critical, 7 days
- 343
- Known exploited
- 1,779
35,521 results · Clear filters · Feed
-
Medium 6.5CVE-2024-57725 Public exploit
An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value wi…
-
High 8.4CVE-2025-26788 Public exploit
StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.
-
High 8.6CVE-2025-22896 Public exploit
mySCADA myPRO Manager Cleartext Storage of Sensitive Information
mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.
-
Critical 10.0CVE-2025-24865 Public exploit
mySCADA myPRO Manager Missing Authentication for Critical Function
The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.
-
High 7.1CVE-2025-26543 Public exploit
WordPress Simple Responsive Menu plugin <= 2.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Responsive Menu: from n/a through <= 2.1.
-
High 8.1
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL …
-
High 7.3CVE-2024-13346 Public exploit
Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly va…
-
High 7.3CVE-2024-57378 Public exploit
Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creat…
-
Medium 5.4CVE-2024-54951 Public exploit
Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that …
-
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certai…
KEV Feb 18, 2025 -
High 8.2CVE-2025-25205 Public exploit
Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers ca…
-
Critical 9.2CVE-2025-25200 Public exploit
Koa has Inefficient Regular Expression Complexity
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out …
-
High 7.1CVE-2025-25198 Public exploit
mailcow: dockerized vulnerable to password reset poisoning
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointin…
-
High 8.1CVE-2024-13800 Public exploit
Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it…
-
Medium 6.4CVE-2024-54160 Public exploit
dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because…
-
High 7.8CVE-2025-21420 Public exploit
Windows Disk Cleanup Tool Elevation of Privilege Vulnerability
Windows Disk Cleanup Tool Elevation of Privilege Vulnerability
-
High 8.1
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0…
KEV Mar 18, 2025 -
Medium 6.3CVE-2024-40586 Public exploit
An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, versi…
-
Medium 5.4CVE-2025-0054 Public exploit
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be la…
-
Medium 6.5
Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the inp…
-
Low 3.8CVE-2024-51324 Public exploit
An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via e…
-
Medium 6.8CVE-2024-54916 Public exploit
An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass au…
-
Medium 5.4
An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stab…
-
Critical 9.9
Remote code execution in Wazuh server
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI param…
KEV Jun 10, 2025 -
High 7.8CVE-2025-21692 Public exploit
net: sched: fix ets qdisc OOB Indexing
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The ov…
-
Critical 9.8CVE-2025-0316 Public exploit
WP Directorybox Manager <= 2.5 - Authentication Bypass
The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible f…
-
High 7.5CVE-2025-25163 Public exploit
WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3.
-
Critical 9.6CVE-2025-25101 Public exploit
WordPress Munk Sites plugin <= 1.0.7 - CSRF to Arbitrary Plugin Installation vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a through <= 1.0.7.
-
Critical 9.8CVE-2024-55215 Public exploit
An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization inte…
-
Medium 4.6CVE-2024-35106 Public exploit
NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. This vulnerability al…
-
High 8.6
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable t…
KEV Feb 7, 2025 -
Medium 4.8CVE-2022-40490 Public exploit
Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerabi…
-
Critical 9.8CVE-2022-40916 Public exploit
Tiny File Manager v2.4.7 and below is vulnerable to session fixation.
-
Medium 5.3CVE-2024-53586 Public exploit
An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a cr…
-
Medium 6.3CVE-2024-48589 Public exploit
Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code v…
-
Critical 9.8CVE-2024-57430 Public exploit
An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attacker…
-
Medium 4.5CVE-2024-57523 Public exploit
Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attack…
-
Medium 6.1CVE-2024-57427 Public exploit
PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints imprope…
-
High 7.5CVE-2024-57610 Public exploit
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user acc…
-
Medium 5.4CVE-2024-57429 Public exploit
A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2…