Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,626
- Last 24h
- 527
- Critical, 7 days
- 345
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2021-46075 Public exploit
A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account user…
-
Unscored —CVE-2021-46076 Public exploit
Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious p…
-
Unscored —CVE-2021-46080 Public exploit
A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF a…
-
High 8.1CVE-2021-46143 Public exploit
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
-
Unscored —
A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base So…
-
Low 3.3
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0…
KEV Dec 10, 2021 -
Unscored —
TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can uplo…
-
High 7.2
Download Monitor < 4.4.5 - Admin+ SQL Injection
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
-
High 8.8CVE-2021-45960 Public exploit
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…
-
Unscored —CVE-2021-44852 Public exploit
An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the d…
-
Medium 6.6
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…
-
Unscored —CVE-2021-45814 Public exploit
Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel…
-
Unscored —CVE-2021-45425 Public exploit
Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScri…
-
High 8.8
User privilege escalation in MinIO
MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `REL…
-
Critical 9.8
Gerapy may contain remote code execution vulnerability
Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
-
Unscored —
security vulnerability on unauthorized access.
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the …
-
Medium 6.8
Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 202…
-
Unscored —CVE-2021-45485 Public exploit
In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…
-
Unscored —
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the pas…
-
Unscored —CVE-2021-44733 Public exploit
A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …
-
Unscored —
WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform …
-
Unscored —CVE-2021-44916 Public exploit
Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a ba…
-
Unscored —CVE-2021-42913 Public exploit
The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cle…
-
Unscored —
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue af…
-
Unscored —CVE-2021-45041 Public exploit
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project m…
-
Medium 5.9
Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…
-
High 7.5CVE-2021-23797 Public exploit
Directory Traversal
All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.
-
High 7.5
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and…
KEV Mar 9, 2026 -
Unscored —CVE-2021-41962 Public exploit
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner f…
-
Unscored —
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection v…
-
Unscored —CVE-2021-0963 Public exploit
In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tap…
-
Unscored —CVE-2021-0954 Public exploit
In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. This could lead to…
-
Unscored —CVE-2021-0928 Public exploit
In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due …
-
Unscored —CVE-2021-44655 Public exploit
Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. …
-
Unscored —CVE-2021-44653 Public exploit
Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel aut…
-
Medium 4.3CVE-2021-43908 Public exploit
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
-
High 7.5CVE-2021-43893 Public exploit
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
-
High 7.8
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.8CVE-2021-43229 Public exploit
Windows NTFS Elevation of Privilege Vulnerability
Windows NTFS Elevation of Privilege Vulnerability