Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,476
- Last 24h
- 556
- Critical, 7 days
- 337
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Medium 6.1CVE-2023-31584 Public exploit
GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerabili…
-
High 7.2CVE-2023-31742 Public exploit
There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attac…
-
Medium 4.3
Ellucian Ethos Identity logout cross site scripting
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the…
-
Medium 6.7CVE-2023-31756 Public exploit
A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running fir…
-
Medium 5.5CVE-2023-26818 Public exploit
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSER…
-
High 7.5CVE-2022-30114 Public exploit
A heap-based buffer overflow in a network service in Fastweb FASTGate MediaAccess FGA2130FWB, firmware version 18.3.n.0…
-
Critical 9.8CVE-2023-28753 Public exploit
netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could…
-
Critical 10.0CVE-2023-2024 Public exploit
Improper Authentication for OpenBlue Enterprise Manager Data Collector
Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.
-
High 7.1
WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions.
-
Medium 6.5CVE-2023-20110 Public exploit
Cisco Smart Software Manager On-Prem SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based m…
-
High 7.2CVE-2019-25137 Public exploit
Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:…
-
Medium 5.4
WordPress Core < 6.2.1 - Directory Traversal
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafte…
-
Medium 4.8CVE-2023-31699 Public exploit
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
-
High 7.2CVE-2023-31702 Public exploit
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to …
-
Medium 5.4CVE-2023-31698 Public exploit
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's securi…
-
Critical 9.8CVE-2023-31902 Public exploit
RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).
-
Critical 9.0CVE-2023-31703 Public exploit
Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 all…
-
High 7.1
WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions.
-
Critical 9.8CVE-2023-27742 Public exploit
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.
-
High 7.5CVE-2023-32309 Public exploit
Arbitrary file inclusion with the pymdowm-snippets extension
PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content…
-
Critical 9.8CVE-2023-32314 Public exploit
Sandbox Escape
vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a resu…
-
Critical 9.8
WAGO: WBM Command Injection in multiple products
In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
-
High 7.5CVE-2023-32784 Public exploit
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a wor…
-
High 7.8CVE-2023-21109 Public exploit
In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error …
-
Medium 6.2CVE-2023-21118 Public exploit
In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lea…
-
Medium 6.7CVE-2023-20696 Public exploit
In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
High 8.8CVE-2023-32073 Public exploit
AVideo command injection vulnerability
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-…
-
Critical 9.8CVE-2023-1934 Public exploit
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQ…
-
Critical 9.8
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.
-
Medium 6.1CVE-2023-29808 Public exploit
Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.
-
Critical 9.8
SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbi…
-
Medium 5.4CVE-2023-29983 Public exploit
Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary c…
-
Critical 9.8
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid c…
-
Critical 9.8CVE-2023-30330 Public exploit
SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v4…
-
Medium 6.5CVE-2023-23169 Public exploit
Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal.
-
Medium 6.8CVE-2022-47880 Public exploit
An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users w…
-
High 7.5CVE-2022-47879 Public exploit
A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load …
-
Unscored —CVE-2023-31445 Public exploit
Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnera…
-
High 7.8CVE-2023-31497 Public exploit
Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security (EPS) all versions prior to v8.0 …
-
Medium 6.1
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informa…