Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,455
- Last 24h
- 639
- Critical, 7 days
- 339
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
High 8.1
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via…
-
Critical 9.8
Ray has arbitrary code execution via jobs submission API
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictl…
-
Unscored —CVE-2023-46944 Public exploit
An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Vi…
-
High 8.2CVE-2023-45539 Public exploit
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive inf…
-
Unscored —CVE-2023-49313 Public exploit
A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unau…
-
Unscored —CVE-2023-49314 Public exploit
Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection a…
-
Critical 9.8
Control iD iDSecure passwordCustom Authentication Bypass
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentic…
-
High 8.8CVE-2023-35985 Public exploit
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due…
-
High 7.3CVE-2023-4590 Public exploit
Buffer Overflow vulnerability in Frhed
Buffer overflow vulnerability in Frhed hex editor, affecting version 1.6.0. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument through the Structured Exception Handler (SEH) registers.
-
Unscored —CVE-2023-48034 Public exploit
An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless ke…
-
Unscored —CVE-2023-47437 Public exploit
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scriptin…
-
Low 3.5
TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting
A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argume…
-
Medium 5.3CVE-2023-47529 Public exploit
WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.
-
Medium 5.3CVE-2023-47668 Public exploit
WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.
-
Critical 9.8
UserPro <= 5.1.1 - Authentication Bypass to Administrator
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthe…
-
Unscored —CVE-2023-47250 Public exploit
In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows…
-
Unscored —CVE-2023-47014 Public exploit
A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 a…
-
Critical 10.0
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relie…
KEV Nov 30, 2023 -
Critical 9.8
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wi…
KEV Aug 27, 2026 -
Medium 6.5CVE-2023-6199 Public exploit
Book Stack v23.10.2 - LFR via Blind SSRF
Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
-
Critical 9.7
XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacke…
-
Medium 5.9CVE-2023-48223 Public exploit
fast-jwt JWT Algorithm Confusion
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match …
-
Unscored —
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attribute…
-
High 7.5
Ray Static File Local File Include
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
-
High 8.0
Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code exec…
-
Critical 9.8
Ray Command Injection in cpu_profile Parameter
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here…
-
Unscored —CVE-2023-43757 Public exploit
Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION al…
-
High 8.8CVE-2023-35080 Public exploit
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticat…
-
Medium 4.7CVE-2023-47125 Public exploit
By-passing Cross-Site Scripting Protection in HTML Sanitizer
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vuln…
-
High 8.8CVE-2023-23583 Public exploit
Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated…
-
Unscored —CVE-2023-31320 Public exploit
Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display pote…
-
High 8.8
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Nov 14, 2023 -
High 7.8CVE-2023-36407 Public exploit
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Apr 13, 2026 -
High 7.0CVE-2023-36427 Public exploit
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
-
Unscored —CVE-2023-46022 Public exploit
SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL command…
-
Unscored —CVE-2023-46023 Public exploit
SQL injection vulnerability in addTask.php in Code-Projects Simple Task List 1.0 allows attackers to obtain sensitive i…
-
Unscored —CVE-2023-46580 Public exploit
Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via th…
-
Unscored —CVE-2023-46024 Public exploit
SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attacker…
-
Unscored —
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not…