Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,457
- Last 24h
- 635
- Critical, 7 days
- 341
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Critical 9.8CVE-2023-40989 Public exploit
SQL injection in jeecgboot
SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
-
Medium 6.1
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…
KEV Feb 12, 2024 -
Unscored —CVE-2023-43144 Public exploit
Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.
-
High 7.0CVE-2023-4504 Public exploit
OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in Septembe…
-
High 8.8
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead t…
KEV Sep 25, 2023 -
High 7.8
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, mac…
KEV Sep 25, 2023 -
Medium 5.5
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A ma…
KEV Sep 25, 2023 -
Critical 9.8
FUXA SQL Injection vulnerability
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
-
High 7.5CVE-2023-31716 Public exploit
FUXA vulnerable to Local File Inclusion
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
-
High 7.5CVE-2023-31718 Public exploit
FUXA local file inclusion vulnerability
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.
-
High 7.5CVE-2023-31717 Public exploit
FUXA SQL Injection vulnerability
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
-
Medium 4.3CVE-2023-43494 Public exploit
Jenkins does not exclude sensitive build variables from search
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to …
-
Critical 10.0CVE-2023-2163 Public exploit
Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation
Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.
-
Medium 5.3CVE-2023-26144 Public exploit
graphql Uncontrolled Resource Consumption vulnerability
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade sys…
-
Medium 4.2CVE-2023-31014 Public exploit
NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application o…
-
Unscored —CVE-2023-36109 Public exploit
Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_st…
-
Unscored —CVE-2023-40930 Public exploit
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via moun…
-
Critical 9.8
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
KEV Oct 4, 2023 -
Unscored —CVE-2020-24089 Public exploit
An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a…
-
Unscored —CVE-2023-36319 Public exploit
File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the actio…
-
Unscored —CVE-2023-40933 Public exploit
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner co…
-
Unscored —
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attacker…
-
Critical 9.8
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
-
Unscored —CVE-2023-43115 Public exploit
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript …
-
Unscored —CVE-2021-26837 Public exploit
SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.1…
-
Low 3.5CVE-2023-5024 Public exploit
Planno Comment cross site scripting
A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has…
-
High 8.2
JumpServer session replays download without authentication
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, O…
-
Medium 5.3CVE-2023-40167 Public exploit
Jetty accepts "+" prefixed value in Content-Length
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…
-
High 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…
-
Unscored —CVE-2023-41436 Public exploit
Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted sc…
-
Unscored —CVE-2023-38891 Public exploit
SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the…
-
High 7.8CVE-2023-36250 Public exploit
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via c…
-
Unscored —CVE-2023-40869 Public exploit
Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute …
-
Unscored —CVE-2023-40868 Public exploit
Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arb…
-
Unscored —CVE-2023-41011 Public exploit
Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows …
-
Unscored —CVE-2023-42362 Public exploit
An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands…
-
Unscored —CVE-2023-37739 Public exploit
i-doit Pro v25 and below was discovered to be vulnerable to path traversal.
-
Unscored —CVE-2023-37756 Public exploit
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creati…
-
Unscored —CVE-2023-37755 Public exploit
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, an…
-
Medium 6.5
PaperCut NG Unauthenticated XMLRPC
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.