Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,470
- Last 24h
- 592
- Critical, 7 days
- 334
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Low 3.5CVE-2023-3163 Public exploit
y_project RuoYi filterKeyword resource consumption
A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulner…
-
Critical 9.8
Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the p…
-
Medium 6.5CVE-2023-32750 Public exploit
Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which…
-
Medium 5.4CVE-2023-32751 Public exploit
Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are gener…
-
High 8.8
Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying …
-
Critical 9.8
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMwar…
KEV Jun 22, 2023 -
High 8.3CVE-2020-36730 Public exploit
CMP <= 3.8.1 - Missing Authorization
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for una…
-
Critical 9.1
WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticat…
-
Critical 9.8
Epsilon Framework Themes (Various Versions) - Function Injection
The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.…
-
High 8.8
Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subsc…
-
High 8.8
An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.
-
High 8.8
D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.
-
High 8.8
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabil…
KEV Jun 16, 2025 -
High 8.1CVE-2023-33977 Public exploit
Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potential…
-
High 8.8
ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissio…
-
High 7.2
A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware ve…
-
Medium 6.5CVE-2023-33477 Public exploit
In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special p…
-
High 7.8CVE-2023-33747 Public exploit
CloudPanel v2.2.2 allows attackers to execute a path traversal.
-
High 7.5CVE-2023-31606 Public exploit
RedCloth Regular Expression Denial of Service issue
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
-
High 7.8CVE-2023-2603 Public exploit
A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer over…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap cor…
KEV Jun 7, 2023 -
High 8.8CVE-2023-33410 Public exploit
Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The v…
-
High 7.8CVE-2023-33733 Public exploit
Reportlab vulnerable to remote code execution
Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.
-
Medium 5.4CVE-2023-33408 Public exploit
Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validatio…
-
Medium 6.5CVE-2023-33409 Public exploit
Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/co…
-
Critical 9.8
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023…
KEV Jun 2, 2023 -
Medium 6.1CVE-2023-33731 Public exploit
Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management c…
-
Critical 9.8CVE-2023-33669 Public exploit
Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c func…
-
Critical 9.8CVE-2023-33476 Public exploit
ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by…
-
High 8.8
‘edit_user’ Capability Privilege Escalation
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admi…
-
High 7.8CVE-2023-34312 Public exploit
In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate po…
-
High 7.8CVE-2023-2598 Public exploit
A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the …
-
Critical 9.8CVE-2023-33730 Public exploit
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.…
-
Medium 6.1CVE-2023-33732 Public exploit
Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 al…
-
High 8.1CVE-2023-3009 Public exploit
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
-
Medium 5.4CVE-2023-33962 Public exploit
JStachio XSS vulnerability: Unescaped single quotes
JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScr…
-
High 8.8CVE-2023-33177 Public exploit
Xibo CMS vulnerable to Remote Code Execution through Zip Slip
Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outsid…
-
Medium 6.1
Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting
The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
-
Critical 9.8CVE-2023-32692 Public exploit
Remote Code Execution Vulnerability in Validation Placeholders
CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model valida…
-
Critical 9.8CVE-2023-34152 Public exploit
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob wi…