Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,568
- Last 24h
- 587
- Critical, 7 days
- 333
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2022-20138 Public exploit
In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app …
-
Unscored —CVE-2022-20130 Public exploit
In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow…
-
Unscored —CVE-2022-20126 Public exploit
In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interact…
-
Unscored —CVE-2022-20186 Public exploit
In kbase_mem_alias of mali_kbase_mem_linux.c, there is a possible arbitrary code execution due to improper input valida…
-
Unscored —CVE-2022-31403 Public exploit
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php.
-
High 7.5CVE-2021-30327 Public exploit
Buffer overflow in sahara protocol while processing commands leads to overwrite of secure configuration data in Snapdra…
-
High 8.4CVE-2022-22057 Public exploit
Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timel…
-
Critical 9.8
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypa…
-
Medium 4.7
WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
-
Unscored —
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connec…
-
High 8.1
Deserialization of Untrusted Data
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote serve…
-
Unscored —CVE-2022-32981 Public exploit
An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in p…
-
Unscored —CVE-2018-17240 Public exploit
There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attack…
-
Unscored —CVE-2022-31402 Public exploit
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php.
-
Unscored —CVE-2021-44117 Public exploit
A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/s…
-
Unscored —CVE-2021-44582 Public exploit
A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remo…
-
Unscored —CVE-2022-27502 Public exploit
RealVNC VNC Server 6.9.0 through 5.1.0 for Windows allows local privilege escalation because an installer repair operat…
-
Medium 6.3CVE-2019-25066 Public exploit
ajenti API privileges management
A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to t…
-
Medium 6.3CVE-2019-25065 Public exploit
OpenNetAdmin os command injection
A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the p…
-
Unscored —
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remot…
-
Unscored —CVE-2022-32272 Public exploit
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before …
-
Unscored —CVE-2022-31325 Public exploit
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
-
Unscored —CVE-2022-31813 Public exploit
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
-
Unscored —
mod_proxy_ajp: Possible request smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…
-
Unscored —
Virtua Cobranca before 12R allows SQL Injection on the login page.
-
Unscored —
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.1…
-
Unscored —CVE-2022-29296 Public exploit
A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attac…
-
Unscored —CVE-2022-27438 Public exploit
Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advance…
-
Unscored —
WPQA < 5.5 - Unauthenticated Private Message Disclosure
The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.
-
Unscored —
WPQA < 5.4 - Reflected Cross-Site Scripting
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
-
Unscored —CVE-2022-1421 Public exploit
Discy < 5.2 - Settings Update via CSRF
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
-
Critical 9.8
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…
KEV Jun 2, 2022 -
High 8.8CVE-2022-29778 Public exploit
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the para…
-
Unscored —CVE-2022-32250 Public exploit
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespace…
-
Unscored —CVE-2022-29597 Public exploit
Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). Any authenticate…
-
Unscored —CVE-2022-32013 Public exploit
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/category/index.php?view=edit&id=.
-
High 7.8
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. Th…
KEV Jun 14, 2022 -
Unscored —CVE-2022-31983 Public exploit
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/manage_request&id=.
-
Unscored —CVE-2022-24702 Public exploit
An issue was discovered in WinAPRS 2.9.0. A buffer overflow in the VHF KISS TNC component allows a remote attacker to a…
-
Medium 4.9
Privilege escalation from administrator in eLabFTW
eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assign itself system administrator privileges within the application, or create a ne…