Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,442
- Last 24h
- 649
- Critical, 7 days
- 338
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Medium 6.2
Numbas editor before 7.3 mishandles editing of themes and extensions.
-
Critical 9.9
Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execut…
-
Medium 5.4CVE-2023-51281 Public exploit
Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via…
-
Critical 9.8CVE-2023-49989 Public exploit
Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.ph…
-
High 7.5CVE-2023-49988 Public exploit
Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.p…
-
Medium 5.4CVE-2023-49987 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allo…
-
Medium 4.7CVE-2023-49986 Public exploit
A cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow at…
-
Medium 6.1CVE-2024-24035 Public exploit
Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hm…
-
High 8.1CVE-2024-22752 Public exploit
Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use …
-
Critical 9.8CVE-2024-27304 Public exploit
pgx SQL Injection via Protocol Message Size Overflow
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple me…
-
High 8.0CVE-2024-28157 Public exploit
Jenkins GitBucket Plugin vulnerable to stored Cross-site Scripting
Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
-
High 7.3CVE-2024-20338 Public exploit
A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, …
-
High 7.5CVE-2023-49980 Public exploit
A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories an…
-
Medium 6.5CVE-2023-49985 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 all…
-
Medium 4.7CVE-2023-49971 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
High 7.5CVE-2023-49979 Public exploit
A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive file…
-
High 8.8CVE-2023-49982 Public exploit
Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers t…
-
Medium 6.1CVE-2023-49973 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
High 7.5CVE-2023-49981 Public exploit
A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensit…
-
Medium 6.1CVE-2023-49974 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
Medium 6.1CVE-2023-49984 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 …
-
Medium 6.8CVE-2023-49983 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 all…
-
High 7.2CVE-2023-49978 Public exploit
Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages an…
-
Medium 5.4CVE-2023-49976 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
Medium 5.4CVE-2023-49977 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
High 7.8
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, …
KEV Mar 6, 2024 -
Critical 9.8
Artica Proxy Unauthenticated PHP Deserialization Vulnerability
The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.
-
High 7.5
Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy adminis…
-
High 8.8CVE-2023-43318 Public exploit
TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification o…
-
Medium 5.8
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references se…
-
Medium 5.5CVE-2024-22889 Public exploit
Phone information disclosure vulnerability
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.
-
Critical 9.8
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
KEV Mar 7, 2024 -
High 7.8CVE-2023-6241 Public exploit
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition…
-
High 7.5CVE-2023-33105 Public exploit
Configuration Issue in WLAN Host and Firmware
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
-
Critical 9.8
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote co…
-
Medium 4.3CVE-2023-49969 Public exploit
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_su…
-
High 8.8CVE-2023-49546 Public exploit
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer…
-
Critical 9.8CVE-2023-49547 Public exploit
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /custo…
-
High 7.3CVE-2023-49968 Public exploit
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_su…
-
Critical 9.8CVE-2023-49970 Public exploit
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /custom…