Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,502
- Last 24h
- 559
- Critical, 7 days
- 334
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Critical 9.8CVE-2022-45477 Public exploit
Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any pr…
-
High 8.8CVE-2022-45771 Public exploit
An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary co…
-
Medium 5.4CVE-2022-43097 Public exploit
Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripti…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…
KEV Dec 5, 2022 -
High 8.3
Remote Code execution in SnakeYAML
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…
-
Critical 9.8CVE-2022-44262 Public exploit
ff4j is vulnerable to Remote Code Execution (RCE)
ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).
-
High 7.5CVE-2022-37017 Public exploit
Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Cont…
-
High 8.8
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920…
-
Critical 9.8CVE-2022-44136 Public exploit
Zenario CMS is vulnerable to Remote Code Execution (RCE).
Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).
-
Medium 4.3CVE-2022-41413 Public exploit
perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attac…
-
Unscored —CVE-2022-4174 Public exploit
Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corr…
-
Medium 6.1CVE-2022-36433 Public exploit
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript …
-
High 8.2CVE-2022-46152 Public exploit
OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_co…
-
High 7.2CVE-2022-3689 Public exploit
HTML Forms < 1.3.25 - Admin+ SQLi
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
-
Critical 9.8CVE-2022-36193 Public exploit
SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent chan…
-
High 8.8CVE-2022-45442 Public exploit
Sinatra vulnerable to Reflected File Download attack
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition hea…
-
High 7.8CVE-2022-45934 Public exploit
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…
-
High 7.5
qs vulnerable to Prototype Pollution
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…
-
High 8.1CVE-2022-38813 Public exploit
PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows att…
-
High 7.8CVE-2022-2650 Public exploit
Improper Restriction of Excessive Authentication Attempts in wger-project/wger
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
-
High 8.0CVE-2022-42896 Public exploit
Info Leak in l2cap_core in the Linux Kernel
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…
-
Critical 9.8CVE-2020-23583 Public exploit
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary…
-
Medium 4.3CVE-2020-23588 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Medium 4.3CVE-2020-23586 Public exploit
A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an una…
-
Medium 6.5CVE-2020-23589 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Low 3.1CVE-2020-23587 Public exploit
A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an…
-
High 8.8CVE-2020-23592 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Critical 9.8CVE-2020-23591 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker …
-
Medium 6.5CVE-2020-23593 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenti…
-
Critical 9.8
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes a…
-
Medium 6.5CVE-2020-23590 Public exploit
A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
High 8.8CVE-2020-23585 Public exploit
A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2…
-
Medium 5.4CVE-2022-35501 Public exploit
Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the d…
-
Medium 5.4CVE-2022-35500 Public exploit
Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
-
Medium 5.4CVE-2022-45472 Public exploit
CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onp…
-
High 8.8CVE-2022-44789 Public exploit
A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to …
-
Critical 9.8CVE-2022-44118 Public exploit
dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
-
Critical 9.6CVE-2022-41924 Public exploit
Tailscale Windows daemon is vulnerable to RCE via CSRF
A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP so…
-
Critical 9.1CVE-2022-41923 Public exploit
Grails Spring Security Core plugin vulnerable to privilege escalation
Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some …
-
Medium 5.4CVE-2022-41446 Public exploit
An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to …