Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,576
- Last 24h
- 585
- Critical, 7 days
- 333
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2022-29622 Public exploit
An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted fi…
-
High 7.5
Shell command injection in gitea
Gitea before 1.16.7 does not escape git fetch remote.
-
Unscored —
WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cg…
-
Unscored —
NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via US…
-
Unscored —CVE-2022-27134 Public exploit
EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which…
-
Medium 6.5CVE-2022-22971 Public exploit
Allocation of Resources Without Limits or Throttling in Spring Framework
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
-
High 7.5CVE-2022-22970 Public exploit
Denial of service in Spring Framework
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
-
High 7.8CVE-2021-26258 Public exploit
Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an auth…
-
Critical 9.8
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
KEV Jul 13, 2023 -
Unscored —
SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.
-
Critical 9.8
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…
KEV May 16, 2022 -
High 7.5
EncryptInterceptor does not provide complete protection on insecure networks
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While th…
-
Unscored —CVE-2022-30594 Public exploit
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass in…
-
Unscored —CVE-2022-30592 Public exploit
liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.
-
Unscored —CVE-2022-30040 Public exploit
Tenda AX1803 v1.0.0.1_2890 is vulnerable to Buffer Overflow. The vulnerability lies in rootfs_ In / goform / setsystime…
-
Unscored —CVE-2022-28078 Public exploit
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in …
-
Unscored —CVE-2022-28077 Public exploit
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in …
-
Unscored —CVE-2022-29932 Public exploit
The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data…
-
Unscored —
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Manage…
-
Unscored —CVE-2022-29008 Public exploit
An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 all…
-
Unscored —
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop M…
-
Unscored —
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Managem…
-
Unscored —CVE-2022-29727 Public exploit
Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup para…
-
Unscored —CVE-2022-28601 Public exploit
A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote at…
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
-
High 7.5CVE-2022-29117 Public exploit
.NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
-
Critical 9.8
Windows Network File System Remote Code Execution Vulnerability
Windows Network File System Remote Code Execution Vulnerability
-
High 8.8CVE-2022-26927 Public exploit
Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
-
High 8.8
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Aug 18, 2022 -
High 8.1
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
-
Unscored —CVE-2022-20120 Public exploit
Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/A
-
Unscored —CVE-2022-20009 Public exploit
In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check…
-
Unscored —CVE-2022-20007 Public exploit
In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app t…
-
Unscored —CVE-2022-20005 Public exploit
In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code an…
-
Unscored —CVE-2022-20004 Public exploit
In checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due to improper input valid…
-
Unscored —CVE-2021-39670 Public exploit
In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validatio…
-
High 7.5
Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party …
-
Unscored —CVE-2022-28986 Public exploit
LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object referenc…
-
Unscored —CVE-2022-28906 Public exploit
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parame…
-
Unscored —CVE-2022-30524 Public exploit
There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mi…