Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,455
- Last 24h
- 638
- Critical, 7 days
- 339
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the int…
-
Unscored —CVE-2023-46018 Public exploit
SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL c…
-
Unscored —CVE-2023-46021 Public exploit
SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands vi…
-
Unscored —CVE-2023-46020 Public exploit
Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code …
-
Unscored —CVE-2023-46015 Public exploit
Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary…
-
Unscored —CVE-2023-46016 Public exploit
Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 's…
-
Unscored —CVE-2023-46017 Public exploit
SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL …
-
Unscored —CVE-2023-46014 Public exploit
SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL …
-
Unscored —CVE-2023-46019 Public exploit
Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary c…
-
High 8.4CVE-2023-47129 Public exploit
Statamic CMS remote code execution via front-end form uploads
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature …
-
High 7.5CVE-2023-47108 Public exploit
DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have…
-
Medium 5.3CVE-2023-47119 Public exploit
HTML injection in oneboxed links
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. …
-
Medium 4.3CVE-2023-45806 Public exploit
Discourse vulnerable to DoS via Regexp Injection in Full Name
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to …
-
Critical 9.8
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a …
KEV Nov 13, 2023 -
Medium 4.3CVE-2023-5546 Public exploit
Moodle: stored xss in quiz grading report via user id number
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
-
Critical 9.8
PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied in…
-
Medium 6.5CVE-2023-45857 Public exploit
Axios Cross-Site Request Forgery Vulnerability
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
-
Unscored —CVE-2023-37790 Public exploit
Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Prof…
-
Critical 9.9CVE-2021-43609 Public exploit
An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within…
-
Medium 6.4CVE-2023-4842 Public exploit
Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied att…
-
Medium 6.1CVE-2023-46998 Public exploit
Bootbox.js Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions.
-
Critical 9.1CVE-2023-46501 Public exploit
An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view …
-
Medium 6.1
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary cod…
-
Unscored —CVE-2023-42284 Public exploit
Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the databa…
-
Unscored —CVE-2023-42283 Public exploit
Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database vi…
-
Medium 5.3CVE-2023-47102 Public exploit
UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a userna…
-
High 7.3CVE-2023-45827 Public exploit
Prototype Pollution vulnerability in @clickbar/dot-diver
Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` functi…
-
Medium 4.9CVE-2023-5968 Public exploit
Password hash in response body after username update
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
-
High 8.5CVE-2023-45657 Public exploit
WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects Nexter: from n/a through 2.0.3.
-
Critical 10.0CVE-2023-4699 Public exploit
Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi…
-
Critical 9.8
Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reque…
-
High 8.8CVE-2022-44569 Public exploit
A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communicat…
-
Medium 5.1CVE-2022-3172 Public exploit
Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third partie…
-
High 8.2CVE-2023-41652 Public exploit
WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.
-
High 8.8CVE-2023-41348 Public exploit
ASUS RT-AX55 - command injection - 4
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to …
-
High 8.8CVE-2023-41346 Public exploit
ASUS RT-AX55 - command injection - 2
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execut…
-
Critical 9.9CVE-2023-46404 Public exploit
PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping…
-
Critical 9.8CVE-2023-46954 Public exploit
SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attack…
-
Critical 9.8CVE-2023-46980 Public exploit
An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privil…
-
Critical 9.9
A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authen…