Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,504
- Last 24h
- 543
- Critical, 7 days
- 333
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
High 7.8CVE-2022-42176 Public exploit
In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.
-
Critical 9.8CVE-2022-37298 Public exploit
Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control
Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to th…
-
High 7.0CVE-2022-41741 Public exploit
NGINX ngx_http_mp4_module vulnerability CVE-2022-41741
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to c…
-
Medium 5.5CVE-2022-39253 Public exploit
Git subject to exposure of sensitive information via local clone of symbolic links
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (wh…
-
Critical 9.8
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…
KEV Jan 8, 2024 -
Critical 9.8
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a …
-
High 8.1CVE-2022-39425 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Critical 9.8
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…
KEV Oct 11, 2022 -
Critical 9.8
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…
KEV Feb 2, 2023 -
Medium 5.9CVE-2022-41540 Public exploit
The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. A…
-
High 8.8
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramet…
-
High 7.8CVE-2022-3569 Public exploit
Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escala…
-
High 7.3CVE-2022-3368 Public exploit
Software Updater of Avira Security for Windows vulnerable to Privilege Escalation
A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.
-
High 7.2
Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.
-
Low 2.4CVE-2022-3546 Public exploit
SourceCodester Simple Cold Storage Management System Create User cross site scripting
A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /csms/admin/?page=user/list of the component Create User Handler. The manipul…
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Critical 9.9
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allow…
-
Critical 9.9
A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.…
-
Low 2.4CVE-2022-3518 Public exploit
SourceCodester Sanitization Management System User Creation cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the component User Creation Handler. The manipulation of the argument First Name/Middle Name/Last Name leads to c…
-
Critical 10.0
Adobe Commerce Stored XSS Arbitrary code execution
Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
-
High 7.8CVE-2022-42899 Public exploit
Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read and stack overflow issue…
-
Critical 9.8
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…
-
High 8.8CVE-2022-37208 Public exploit
JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filte…
-
High 7.4CVE-2022-39299 Public exploit
Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession…
-
Medium 4.3CVE-2022-3464 Public exploit
puppyCMS settings.php cross site scripting
A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remot…
-
High 8.4CVE-2022-22077 Public exploit
Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile
-
High 7.5CVE-2022-3358 Public exploit
Using a Custom Cipher with NID_undef may lead to NULL encryption
OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to imp…
-
Unscored —CVE-2022-39802 Public exploit
SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a fil…
-
High 7.0CVE-2022-38029 Public exploit
Windows ALPC Elevation of Privilege Vulnerability
Windows ALPC Elevation of Privilege Vulnerability
-
High 7.5CVE-2022-41404 Public exploit
org.ini4j allows attackers to cause a Denial of Service (DoS)
An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
-
High 7.8CVE-2022-41032 Public exploit
NuGet Client Elevation of Privilege Vulnerability
NuGet Client Elevation of Privilege Vulnerability
-
High 7.8
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
-
Unscored —CVE-2022-20413 Public exploit
In start of Threads.cpp, there is a possible way to record audio during a phone call due to a logic error in the code. …
-
Unscored —CVE-2022-20421 Public exploit
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could l…
-
Unscored —CVE-2022-20409 Public exploit
In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This could lead to…
-
Unscored —CVE-2022-42703 Public exploit
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
-
Unscored —CVE-2022-39959 Public exploit
Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini fo…
-
High 8.0CVE-2022-39290 Public exploit
CSRF key bypass using HTTP methods in zoneminder
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web application. These modifications include replacing HTTP POS…
-
Medium 5.4CVE-2022-39291 Public exploit
Denial of service through logs in zoneminder
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was …
-
High 7.6CVE-2022-39285 Public exploit
Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder
ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code…