Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,476
- Last 24h
- 556
- Critical, 7 days
- 337
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Critical 9.1CVE-2023-32070 Public exploit
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This h…
-
High 7.1
WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
-
High 8.8CVE-2023-29930 Public exploit
An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execut…
-
High 7.5CVE-2023-27564 Public exploit
n8n Information Disclosure vulnerability
The n8n package 0.218.0 for Node.js allows Information Disclosure.
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
High 7.8CVE-2023-29343 Public exploit
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV May 9, 2023 -
Medium 6.5CVE-2023-29324 Public exploit
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
-
High 7.2
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
KEV Mar 26, 2024 -
Critical 9.1CVE-2023-31126 Public exploit
Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. Th…
-
High 7.3CVE-2023-2594 Public exploit
SourceCodester Food Ordering Management System Registration sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. It is possible…
-
High 7.2
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that coul…
-
High 7.1CVE-2023-2591 Public exploit
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
-
High 7.2
NEX-Forms < 8.4 - Admin+ SQL Injection
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query.
-
High 7.8
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused…
-
Critical 9.8CVE-2023-30092 Public exploit
SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter.
-
Critical 9.8CVE-2023-30185 Public exploit
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\Syste…
-
High 7.5
Path Traversal in Ghost
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
-
Medium 5.4CVE-2023-2516 Public exploit
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
-
Critical 9.8
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/…
-
High 7.3
Weaver E-Office unrestricted upload
A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted …
-
High 7.8CVE-2023-25438 Public exploit
An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escala…
-
High 7.5CVE-2023-25289 Public exploit
Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.657…
-
Critical 9.8
Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability
A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within t…
-
Critical 9.8
Remote Code Execution in OpenTSDB
Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that w…
-
Critical 9.3CVE-2022-30995 Public exploit
Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Pro…
-
Critical 9.3CVE-2022-3405 Public exploit
Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The followin…
-
Medium 5.4CVE-2023-29839 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows a…
-
High 7.8CVE-2017-11197 Public exploit
In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user …
-
High 7.5CVE-2023-30861 Public exploit
Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…
-
Medium 5.4CVE-2023-29918 Public exploit
RosarioSIS vulnerable to CSV Injection
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
-
High 8.1CVE-2023-31435 Public exploit
Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire …
-
Medium 5.4CVE-2023-31434 Public exploit
The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in …
-
High 8.8CVE-2023-31433 Public exploit
A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated att…
-
Medium 6.5
Moodle: tinymce loaders susceptible to arbitrary folder creation
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
-
Critical 9.1
Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authentic…
-
Critical 9.6CVE-2022-47877 Public exploit
A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary we…
-
High 8.8
A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to e…
-
Medium 6.5
Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of da…
-
Critical 9.1CVE-2022-47876 Public exploit
The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code …