Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,458
- Last 24h
- 634
- Critical, 7 days
- 341
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Critical 10.0
Craft CMS Remote Code Execution vulnerability
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed i…
-
Medium 5.5CVE-2023-3280 Public exploit
Cortex XDR Agent: Local Windows User Can Disable the Agent
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent.
-
Unscored —CVE-2023-42469 Public exploit
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with …
-
Unscored —CVE-2023-42468 Public exploit
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls…
-
Medium 5.9CVE-2023-4813 Public exploit
Glibc: potential use-after-free in gaih_inet()
A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/…
-
Critical 9.9
Printer web page invalid command execution
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to…
-
High 8.0
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
High 7.8
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
KEV Sep 12, 2023 -
High 8.8
Windows Themes Remote Code Execution Vulnerability
Windows Themes Remote Code Execution Vulnerability
-
High 8.8
libwebp: OOB write in BuildHuffmanTable
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
KEV Sep 13, 2023 -
High 8.2CVE-2022-48474 Public exploit
Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Send…
-
High 8.2CVE-2022-4896 Public exploit
Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows w…
-
Unscored —CVE-2023-35687 Public exploit
In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to…
-
High 8.8
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the co…
KEV Sep 13, 2023 -
Unscored —CVE-2023-35671 Public exploit
In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read t…
-
Medium 6.1CVE-2023-4294 Public exploit
URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short…
-
High 7.5CVE-2023-4278 Public exploit
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
-
Unscored —CVE-2020-24088 Public exploit
An issue was discovered in MmMapIoSpace routine in Foxconn Live Update Utility 2.1.6.26, allows local attackers to esca…
-
High 7.8CVE-2023-39063 Public exploit
Buffer Overflow vulnerability in RaidenFTPD 2.4.4005 allows a local attacker to execute arbitrary code via the Server n…
-
High 8.8
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_appl…
KEV Jun 2, 2025 -
Unscored —CVE-2023-38829 Public exploit
An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and trace…
-
High 7.2
Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.
-
High 7.8CVE-2023-31468 Public exploit
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\…
-
Unscored —CVE-2023-31067 Public exploit
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on s…
-
Unscored —CVE-2023-31068 Public exploit
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on s…
-
Unscored —CVE-2023-31069 Public exploit
An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML …
-
Unscored —CVE-2023-27470 Public exploit
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a p…
-
Unscored —CVE-2023-41593 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow…
-
Unscored —CVE-2023-42470 Public exploit
The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a craf…
-
Unscored —CVE-2023-42471 Public exploit
The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript cod…
-
Unscored —CVE-2023-39320 Public exploit
Arbitrary code execution via go.mod toolchain directive in cmd/go
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the…
-
Unscored —CVE-2014-5329 Public exploit
GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user opera…
-
Unscored —CVE-2023-39712 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows att…
-
Unscored —
SolarView Compact < 6.00 is vulnerable to Directory Traversal.
-
Unscored —CVE-2023-41575 Public exploit
Multiple stored cross-site scripting (XSS) vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 …
-
Medium 6.1CVE-2023-41564 Public exploit
Cockpit CMS arbitrary file upload vulnerability
An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file.
-
Unscored —CVE-2023-37759 Public exploit
Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthentica…
-
Critical 9.9CVE-2023-40029 Public exploit
Cluster secret might leak in cluster details page in Argo CD
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. p…
-
High 7.8
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.…
KEV Sep 11, 2023 -
High 7.5CVE-2023-30800 Public exploit
MikroTik RouterOS Web Interface Heap Corruption
The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immed…