Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,583
- Last 24h
- 565
- Critical, 7 days
- 342
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Medium 5.5CVE-2022-24483 Public exploit
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
Unscored —CVE-2022-28113 Public exploit
An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user …
-
Medium 5.9CVE-2022-24853 Public exploit
File system exposure in Metabase
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a part…
-
High 7.5CVE-2022-22968 Public exploit
Improper handling of case sensitivity in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower ca…
-
Medium 6.1CVE-2022-1257 Public exploit
Improper Verification of Cryptographic Signature by McAfee Agent
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database fil…
-
Unscored —
An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default…
-
High 8.2CVE-2022-24818 Public exploit
Unchecked JNDI lookups in GeoTools
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code…
-
Critical 10.0
Improper Control of Generation of Code in jai-ext
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and …
KEV Jun 26, 2024 -
Unscored —CVE-2021-42136 Public exploit
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allow…
-
High 7.8CVE-2015-20107 Public exploit
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the…
-
High 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due …
KEV Apr 15, 2022 -
Unscored —
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities…
-
Unscored —
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAut…
-
Unscored —
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does …
-
Critical 9.8
Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluatio…
-
Critical 9.8
SQL Injection in Django
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…
-
Medium 6.0CVE-2022-24765 Public exploit
Uncontrolled search for the Git directory in Git for Windows
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, …
-
Critical 9.8
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templ…
KEV Apr 14, 2022 -
Unscored —CVE-2021-32162 Public exploit
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
-
Unscored —CVE-2021-32161 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
-
Unscored —CVE-2021-32160 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
-
Unscored —CVE-2021-32159 Public exploit
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
-
Unscored —CVE-2021-32158 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
-
Unscored —CVE-2021-32157 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
-
Unscored —CVE-2021-32156 Public exploit
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
-
Unscored —CVE-2022-26180 Public exploit
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
-
Unscored —CVE-2021-43009 Public exploit
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the requ…
-
High 7.3CVE-2022-26671 Public exploit
TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials
Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt…
-
Unscored —
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fi…
-
Unscored —
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
-
Unscored —
Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileg…
-
Medium 5.4CVE-2021-46416 Public exploit
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acc…
-
Unscored —CVE-2021-40375 Public exploit
Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having …
-
Unscored —CVE-2021-40374 Public exploit
A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patie…
-
Unscored —
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remot…
-
High 8.8CVE-2022-24780 Public exploit
Code Injection in Combodo iTop
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user priv…
-
Unscored —CVE-2020-23349 Public exploit
An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivi…
-
Unscored —CVE-2022-23909 Public exploit
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This migh…
-
High 7.5
Files or Directories Accessible to External Parties in Adminer
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.