Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,639
- Last 24h
- 527
- Critical, 7 days
- 343
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —
Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat a…
-
Critical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation…
KEV Jan 10, 2022 -
Unscored —CVE-2021-41382 Public exploit
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
-
Unscored —
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
-
High 8.8CVE-2021-25741 Public exploit
Symlink Exchange Can Allow Host Filesystem Access
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
-
Unscored —CVE-2021-24741 Public exploit
Support Board < 3.3.4 - Multiple Unauthenticated SQL Injections
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections whi…
-
Unscored —CVE-2021-41073 Public exploit
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IO…
-
Medium 5.3
BulletProof Security <= 5.1 Sensitive Information Disclosure
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database…
-
High 8.1CVE-2021-39214 Public exploit
Lacking Protection against HTTP Request Smuggling in mitmproxy
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/…
-
Critical 9.0
mod_proxy SSRF
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
KEV Dec 1, 2021 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
Critical 9.9
Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Comp…
-
Unscored —CVE-2021-40964 Public exploit
A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to…
-
Unscored —CVE-2021-40845 Public exploit
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload i…
-
High 8.8
Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An a…
KEV Nov 3, 2021 -
High 7.8
Open Management Infrastructure Elevation of Privilege Vulnerability
Open Management Infrastructure Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.8
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8CVE-2021-38639 Public exploit
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.9
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…
KEV Jun 9, 2022 -
High 7.2
UDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 7.2
UDP Technology/Geutebrück camera devices: Command injection in command parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 7.2
UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 7.2
UDP Technology/Geutebrück camera devices: Command injection in environment.lang parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 7.2
UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 7.2
UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.
-
High 7.2
UDP Technology/Geutebrück camera devices: Command injection in preserve parameter leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 7.2
UDP Technology/Geutebrück camera devices: command injection leading to RCE
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
-
Critical 9.8
UDP Technology/Geutebrück camera devices: Authentication Bypass
Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service.
-
Critical 9.8
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous…
KEV Jan 18, 2022 -
High 8.4
Deserialization of Untrusted Data in parlai
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
-
Unscored —CVE-2021-40373 Public exploit
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_co…
-
High 7.5CVE-2021-40839 Public exploit
Infinite Loop in rencode
The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
-
Critical 9.9CVE-2021-32724 Public exploit
check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack
check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or `schedule`…
-
Medium 4.0CVE-2021-25461 Public exploit
An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow.
-
Critical 9.8
Apache Airflow: Variable Import endpoint missed authentication check
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclo…
-
Unscored —CVE-2021-40223 Public exploit
Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configu…
-
Unscored —CVE-2021-40222 Public exploit
Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code exe…