Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,634
- Last 24h
- 530
- Critical, 7 days
- 342
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2021-24807 Public exploit
Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically e…
-
Unscored —CVE-2021-24664 Public exploit
WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
-
Unscored —
Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site b…
-
Medium 5.3
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. Th…
-
Unscored —
An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained …
-
Unscored —
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitori…
-
Unscored —CVE-2021-42670 Public exploit
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the annou…
-
Unscored —
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which al…
-
Unscored —CVE-2021-42668 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_cl…
-
Unscored —
A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-mana…
-
Unscored —CVE-2021-42666 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_ques…
-
Unscored —CVE-2021-42665 Public exploit
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of ind…
-
Unscored —CVE-2021-42664 Public exploit
A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) …
-
Unscored —
An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via t…
-
Unscored —CVE-2021-42662 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System …
-
Critical 9.8
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…
KEV Mar 25, 2022 -
Critical 10.0CVE-2021-40113 Public exploit
Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities
Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a d…
-
Unscored —CVE-2021-43032 Public exploit
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertis…
-
Unscored —CVE-2021-43339 Public exploit
In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via fil…
-
Unscored —CVE-2021-43141 Public exploit
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter …
-
Unscored —CVE-2021-43140 Public exploit
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
-
Unscored —
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communic…
-
Unscored —CVE-2017-5123 Public exploit
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
-
High 7.5
Uncontrolled Recursion in Akka HTTP
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
-
Unscored —CVE-2021-37980 Public exploit
Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially…
-
Unscored —
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual…
-
High 8.3CVE-2021-42694 Public exploit
An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allow…
-
Medium 5.9CVE-2021-36808 Public exploit
A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before ver…
-
Unscored —CVE-2021-41646 Public exploit
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciousl…
-
Unscored —CVE-2021-41645 Public exploit
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a …
-
Unscored —CVE-2021-41644 Public exploit
Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously cra…
-
Unscored —CVE-2021-41643 Public exploit
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload fi…
-
Unscored —CVE-2021-3441 Public exploit
A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cros…
-
Unscored —
SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.
-
Unscored —CVE-2021-31624 Public exploit
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows att…
-
Unscored —CVE-2020-23546 Public exploit
IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted XBM fi…
-
Unscored —CVE-2021-30809 Public exploit
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchO…
-
Unscored —CVE-2021-37748 Public exploit
Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.…
-
High 8.6CVE-2021-41078 Public exploit
Nameko Arbitrary code execution due to YAML deserialization
Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.
-
Unscored —
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Mova…