Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,454
- Last 24h
- 638
- Critical, 7 days
- 339
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
High 7.5CVE-2023-51127 Public exploit
FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper acces…
-
High 8.8CVE-2023-49471 Public exploit
Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not valida…
-
High 7.3
Likeshop HTTP POST Request File.php userFormImage unrestricted upload
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipul…
-
Medium 6.5
Windows Themes Spoofing Vulnerability
Windows Themes Spoofing Vulnerability
-
Medium 5.7CVE-2024-21306 Public exploit
Microsoft Bluetooth Driver Spoofing Vulnerability
Microsoft Bluetooth Driver Spoofing Vulnerability
-
High 7.8CVE-2024-20656 Public exploit
Visual Studio Elevation of Privilege Vulnerability
Visual Studio Elevation of Privilege Vulnerability
-
Medium 4.4CVE-2024-21305 Public exploit
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
-
High 7.8CVE-2024-20698 Public exploit
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.3CVE-2024-20696 Public exploit
Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
-
High 8.8
Windows Kerberos Security Feature Bypass Vulnerability
Windows Kerberos Security Feature Bypass Vulnerability
-
Medium 6.6CVE-2024-20666 Public exploit
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
Critical 9.8CVE-2023-50643 Public exploit
An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode …
-
Medium 5.3
WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.
-
High 7.8CVE-2022-3328 Public exploit
snapd Race Condition vulnerability
Race condition in snap-confine's must_mkdir_and_open_with_perms()
-
Medium 5.3CVE-2022-2602 Public exploit
io_uring UAF, Unix SCM garbage collection
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
High 7.5
pyLoad unauthenticated flask configuration leakage
pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
-
Medium 5.3
Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure
A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to in…
-
Medium 6.5CVE-2023-52271 Public exploit
The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process…
-
High 7.8
Arbitrary file write on Decoding
Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktoo…
-
High 7.5
Improper Handling of Exceptional Conditions in Newtonsoft.Json
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending…
-
Medium 6.3
spider-flow FunctionController.java FunctionService.saveFunction code injection
A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It …
-
Medium 6.1
Popup Builder < 4.2.3 - Unauthenticated Stored XSS
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
-
High 7.5
Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.
-
High 8.8
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metach…
-
Medium 4.3CVE-2023-7173 Public exploit
PHPGurukul Hospital Management System registration.php cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible …
-
High 7.3CVE-2023-7172 Public exploit
PHPGurukul Hospital Management System Admin Dashboard sql injection
A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Dashboard. The manipulation leads to sql injection. The attack may be l…
-
Medium 5.9CVE-2023-44088 Public exploit
SQL Injection in Visual Console
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora …
-
Critical 9.9CVE-2023-47840 Public exploit
WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)
Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.
-
High 8.8
Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?act…
-
Unscored —CVE-2023-50070 Public exploit
Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?act…
-
Critical 9.3
WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.
-
High 7.8CVE-2023-50445 Public exploit
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000…
-
Critical 9.8CVE-2023-43481 Public exploit
An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote at…
-
Unscored —CVE-2023-43955 Public exploit
The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. Th…
-
Unscored —CVE-2023-47883 Public exploit
The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code…
-
Unscored —CVE-2023-47882 Public exploit
The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to…
-
Unscored —CVE-2023-49003 Public exploit
An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via intera…
-
Unscored —CVE-2023-49002 Public exploit
An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended ac…