Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,448
- Last 24h
- 634
- Critical, 7 days
- 338
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Medium 6.5CVE-2022-23093 Public exploit
Stack overflow in ping(8)
ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an …
-
High 7.2CVE-2024-24386 Public exploit
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vital…
-
High 7.5
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote att…
-
High 7.5
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to …
-
Medium 6.0CVE-2023-31346 Public exploit
Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.
-
High 8.1
Internet Shortcut Files Security Feature Bypass Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
KEV Feb 13, 2024 -
High 8.8
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
-
High 8.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
Critical 9.8
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
KEV Feb 6, 2025 -
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
KEV Mar 4, 2024 -
High 8.3
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy S…
-
Medium 5.8
QTS, QuTS hero, QuTScloud
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Q…
-
Medium 6.5CVE-2023-49339 Public exploit
Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/…
-
Critical 9.8CVE-2024-24142 Public exploit
Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.
-
Critical 9.8CVE-2023-6036 Public exploit
Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to…
-
High 7.2CVE-2024-0566 Public exploit
Smart Manager < 8.28.0 - Admin+ SQL Injection
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
-
Medium 5.4CVE-2023-46615 Public exploit
WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7.
-
High 7.5CVE-2024-24926 Public exploit
WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
-
Critical 9.8
Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" paramet…
-
Medium 6.5CVE-2024-23724 Public exploit
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer rep…
-
High 7.5CVE-2024-21490 Public exploit
angular vulnerable to super-linear runtime due to backtracking
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-craf…
-
Low 2.0CVE-2024-1247 Public exploit
Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which mig…
-
High 8.8
Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.…
-
Critical 9.6
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0…
KEV Feb 9, 2024 -
Medium 5.1CVE-2024-22318 Public exploit
IBM i Access Client Solutions information disclosure
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabl…
-
High 7.8CVE-2024-23749 Public exploit
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insuffi…
-
High 7.8CVE-2024-25004 Public exploit
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insu…
-
High 7.8CVE-2024-25003 Public exploit
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insu…
-
Critical 9.6CVE-2023-48974 Public exploit
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges…
-
Critical 9.8
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php…
-
Medium 6.1
Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via …
-
Critical 9.8CVE-2024-24495 Public exploit
SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbi…
-
Medium 6.1CVE-2024-24034 Public exploit
Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers …
-
Critical 9.8
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company lo…
-
High 8.8
graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster co…
-
Medium 6.1CVE-2024-24816 Public exploit
Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in t…
-
Low 2.4CVE-2024-1269 Public exploit
SourceCodester Product Management System supplier.php cross site scripting
A vulnerability has been found in SourceCodester Product Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /supplier.php. The manipulation of the argument supplier_name/supplier_contact leads to cross sit…
-
Medium 5.4
Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.…
-
Medium 5.5CVE-2024-24488 Public exploit
An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive informati…
-
High 7.2CVE-2023-43482 Public exploit
A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router…