Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,502
- Last 24h
- 541
- Critical, 7 days
- 334
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Jan 10, 2023 -
High 7.0CVE-2022-41114 Public exploit
Windows Bind Filter Driver Elevation of Privilege Vulnerability
Windows Bind Filter Driver Elevation of Privilege Vulnerability
-
Critical 9.8
Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…
KEV Jul 11, 2023 -
Medium 5.5CVE-2022-44318 Public exploit
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c w…
-
High 8.1CVE-2022-44311 Public exploit
html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo…
-
Medium 5.5CVE-2022-44312 Public exploit
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in express…
-
High 7.5CVE-2022-43343 Public exploit
N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken() at Main.c.
-
Medium 5.4CVE-2022-43144 Public exploit
A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web …
-
High 7.8CVE-2022-20452 Public exploit
In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused…
-
Medium 5.4CVE-2021-40303 Public exploit
perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.
-
Medium 4.7CVE-2021-42205 Public exploit
ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows loc…
-
Critical 9.8CVE-2022-31691 Public exploit
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse C…
-
Medium 5.4CVE-2021-39473 Public exploit
Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and cont…
-
High 8.8
Remote Code Execution through dashboard PDF generation component in Splunk Enterprise
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
-
High 7.5CVE-2022-32287 Public exploit
Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives
A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA…
-
High 8.8CVE-2022-38374 Public exploit
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0…
-
High 7.5CVE-2022-3509 Public exploit
Parsing issue in protobuf textformat
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages wit…
-
Medium 6.5CVE-2022-34662 Public exploit
Apache DolphinScheduler prior to 3.0.0 allows path traversal
When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher
-
High 7.8CVE-2022-32898 Public exploit
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS V…
-
High 7.8CVE-2022-32947 Public exploit
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13,…
-
Medium 5.5CVE-2022-32862 Public exploit
This issue was addressed with improved data protection. This issue is fixed in macOS Big Sur 11.7.1, macOS Ventura 13, …
-
High 7.8CVE-2022-32932 Public exploit
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 an…
-
Unscored —CVE-2022-3656 Public exploit
Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass…
-
Unscored —CVE-2022-3653 Public exploit
Heap buffer overflow in Vulkan in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit…
-
High 7.5
X.509 Email Address 4-byte Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the ap…
-
High 7.5
X.509 Email Address Variable Length Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an appli…
-
High 8.8CVE-2022-26717 Public exploit
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, watchOS 8.6, iO…
-
Critical 9.8CVE-2022-31692 Public exploit
Spring Security authorization rules can be bypassed via forward or include dispatcher types
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expe…
-
High 8.8CVE-2022-3357 Public exploit
Smart Slider 3 < 3.5.1.11 - PHP Object Injection
The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site.
-
High 7.3
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
-
Critical 9.8
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via …
-
Medium 6.5CVE-2022-26884 Public exploit
Apache DolphinScheduler exposes files without authentication
Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
-
Medium 6.8
gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vuln…
-
High 8.8CVE-2022-37202 Public exploit
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list
-
Unscored —CVE-2022-27913 Public exploit
[20221002] - Core - RXSS through reflection of user input in headings
An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.
-
High 8.8
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…
KEV Mar 30, 2023 -
Critical 9.8
Skipper vulnerable to SSRF via X-Skipper-Proxy
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
-
High 7.5CVE-2022-43680 Public exploit
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…
-
High 7.2
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
-
Medium 5.4CVE-2022-41358 Public exploit
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrar…