Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,464
- Last 24h
- 616
- Critical, 7 days
- 342
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2023-31851 Public exploit
Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via …
-
Unscored —CVE-2023-31852 Public exploit
Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the ifa…
-
Unscored —CVE-2023-31853 Public exploit
Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parame…
-
High 7.5
Path traversal in copyparty
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside …
-
High 8.1CVE-2023-37273 Public exploit
Docker escape in Auto-GPT when running from docker-compose.yml included in git repo
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing `docker compose run auto-gpt` in the repo root uses a different docker-c…
-
High 7.0
Heap overflow issue with the Lua cjson library used by Redis
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions…
-
High 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and…
-
Unscored —CVE-2023-34132 Public exploit
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-th…
-
High 8.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall G…
-
Critical 9.8
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…
-
Unscored —CVE-2023-33768 Public exploit
Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WS…
-
Unscored —CVE-2023-31704 Public exploit
Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote atta…
-
Unscored —CVE-2023-31705 Public exploit
A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated…
-
Unscored —CVE-2023-37598 Public exploit
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial o…
-
Unscored —CVE-2023-37786 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts …
-
Unscored —
An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
-
Unscored —CVE-2022-42045 Public exploit
Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zema…
-
Unscored —CVE-2023-21251 Public exploit
In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper i…
-
Unscored —CVE-2023-21246 Public exploit
In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to…
-
Unscored —CVE-2023-21238 Public exploit
In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could…
-
Unscored —CVE-2023-20918 Public exploit
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused de…
-
Medium 5.9CVE-2023-3635 Public exploit
Okio GzipSource unhandled exception Denial of Service
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
-
High 7.3
Boss Mini document file inclusion
A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack r…
-
Unscored —CVE-2023-37456 Public exploit
The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affe…
-
Critical 9.8
Apache RocketMQ: Possible remote code execution when using the update configuration function
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can ex…
-
Unscored —CVE-2023-33902 Public exploit
In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no addi…
-
Unscored —CVE-2023-33668 Public exploit
DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover account…
-
Unscored —CVE-2023-36266 Public exploit
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Brow…
-
Unscored —CVE-2023-30226 Public exploit
An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to …
-
Unscored —
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sen…
-
Unscored —CVE-2023-29406 Public exploit
Insufficient sanitization of Host header in net/http
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Reque…
-
High 7.5
Windows Search Remote Code Execution Vulnerability
Windows Search Remote Code Execution Vulnerability
KEV Jul 17, 2023 -
High 7.8
Windows Error Reporting Service Elevation of Privilege Vulnerability
Windows Error Reporting Service Elevation of Privilege Vulnerability
KEV Jul 11, 2023 -
High 7.8CVE-2023-35317 Public exploit
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
-
High 7.8CVE-2023-33148 Public exploit
Microsoft Office Elevation of Privilege Vulnerability
Microsoft Office Elevation of Privilege Vulnerability
-
High 7.8CVE-2023-3269 Public exploit
Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbit…
-
Unscored —CVE-2023-36163 Public exploit
Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary cod…
-
Unscored —CVE-2023-37596 Public exploit
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of …
-
Unscored —CVE-2023-37190 Public exploit
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrar…
-
Unscored —CVE-2023-37189 Public exploit
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attac…