Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,564
- Last 24h
- 598
- Critical, 7 days
- 333
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2022-36234 Public exploit
SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulner…
-
Unscored —CVE-2022-34556 Public exploit
PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.
-
Medium 5.4CVE-2022-34140 Public exploit
Feehi CMS Cross-site Scripting
A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.
-
Medium 6.5
Lack of authentication mechanism in Jenkins Git Plugin webhook
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
High 8.8
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…
KEV Apr 15, 2022 -
Critical 9.0CVE-2022-35131 Public exploit
Joplin is vulnerable to arbitrary code execution
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
-
Unscored —CVE-2022-24992 Public exploit
A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversa…
-
Unscored —CVE-2022-34962 Public exploit
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) v…
-
High 7.5
Moodle Arbitrary file read when importing lesson questions
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks.…
-
Critical 9.8CVE-2022-35649 Public exploit
Moodle PostScript Code Injection
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation…
-
Unscored —CVE-2022-34961 Public exploit
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) v…
-
Unscored —CVE-2022-34963 Public exploit
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) v…
-
Unscored —
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
-
High 8.8
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corru…
KEV Mar 28, 2022 -
Critical 9.8
Advantech iView
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
-
Unscored —CVE-2022-35899 Public exploit
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a loca…
-
Medium 6.0CVE-2022-22555 Public exploit
Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially…
-
Critical 9.8
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…
KEV Jul 29, 2022 -
Unscored —
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via vi…
-
Unscored —
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via …
-
Unscored —
Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via t…
-
Medium 6.1CVE-2022-31160 Public exploit
jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…
-
High 7.0CVE-2022-31144 Public exploit
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7…
-
Unscored —CVE-2022-34024 Public exploit
Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident modul…
-
Critical 9.8
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…
KEV Sep 22, 2022 -
High 7.8CVE-2022-30526 Public exploit
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 …
-
High 7.5
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…
-
Critical 9.8
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Int…
-
High 7.8CVE-2022-28672 Public exploit
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 8.8
Apache Spark shell command injection vulnerability via Spark UI
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…
KEV Mar 7, 2023 -
High 7.2
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level pe…
-
Unscored —CVE-2022-27434 Public exploit
UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the Profile…
-
Critical 9.8
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form re…
KEV Aug 25, 2022 -
Critical 9.8
Octobot mishandles Tentacles upload
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
-
Medium 4.2CVE-2022-25869 Public exploit
Angular (deprecated package) Cross-site Scripting
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <t…
-
High 7.9CVE-2022-31159 Public exploit
Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applicatio…
-
Unscored —CVE-2022-32118 Public exploit
Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory …
-
Unscored —CVE-2022-32119 Public exploit
Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo fun…
-
Critical 10.0
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py fil…