Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,583
- Last 24h
- 547
- Critical, 7 days
- 342
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2022-25584 Public exploit
Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive infor…
-
Unscored —CVE-2022-26982 Public exploit
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting…
-
High 7.2CVE-2022-26986 Public exploit
SQL injection in ImpressCMS
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can …
-
High 8.7
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 befo…
-
Critical 9.1
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/E…
-
High 8.6
Kyocera Net View Address Book Exposure
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
-
High 7.5
Path Traversal in Moment.js
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…
-
Unscored —
Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitra…
-
Low 3.5CVE-2022-0088 Public exploit
Cross-Site Request Forgery (CSRF) in yourls/yourls
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
-
Critical 9.8
Remote code injection in dompdf/dompdf
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
-
Medium 5.5CVE-2022-1068 Public exploit
Modbus Tools Modbus Slave Stack-Based Buffer Overflow
Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.
-
Critical 9.8
Remote Code Execution in Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…
KEV Apr 4, 2022 -
Unscored —
Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers t…
-
Critical 9.8
Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …
KEV Aug 25, 2022 -
High 7.8CVE-2022-27772 Public exploit
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only…
-
Unscored —CVE-2021-39749 Public exploit
In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission ch…
-
Unscored —CVE-2021-3456 Public exploit
An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman client…
-
Medium 6.8CVE-2022-1163 Public exploit
Cross-site Scripting (XSS) - Stored in mineweb/minewebcms
Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
-
Unscored —CVE-2022-24693 Public exploit
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily …
-
Medium 6.5
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…
KEV Jul 17, 2024 -
Unscored —CVE-2021-43701 Public exploit
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/artic…
-
Medium 5.3CVE-2022-1077 Public exploit
TEM FLEX-1080/FLEX-1085 Log information disclosure
A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated…
-
Unscored —CVE-2022-26269 Public exploit
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages.
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Pri…
-
Unscored —CVE-2022-23884 Public exploit
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by Pur…
-
Critical 9.8
SQL Injection in ImpressCMS
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
-
Unscored —
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to…
-
Unscored —CVE-2021-40906 Public exploit
CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is i…
-
High 8.8CVE-2021-40905 Public exploit
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the upl…
-
Unscored —CVE-2021-40904 Public exploit
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Do…
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
Medium 6.1
Cross-site Scripting in Keycloak
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
-
Critical 9.8
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…
KEV Mar 31, 2022 -
High 7.5
Nokogiri affected by zlib's Out-of-bounds Write vulnerability
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
-
Unscored —
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with…
-
Unscored —CVE-2022-26629 Public exploit
An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function du…
-
Unscored —CVE-2020-20093 Public exploit
The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properl…
-
Unscored —
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER …
-
Unscored —CVE-2022-27254 Public exploit
The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allow…
-
Critical 10.0CVE-2021-27460 Public exploit
Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthentica…