Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,639
- Last 24h
- 527
- Critical, 7 days
- 341
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Medium 6.7CVE-2021-1961 Public exploit
Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdra…
-
Unscored —
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP reques…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …
KEV Nov 3, 2021 -
Unscored —CVE-2021-1883 Public exploit
This issue was addressed with improved checks. This issue is fixed in Security Update 2021-004 Mojave, iOS 14.5 and iPa…
-
Unscored —CVE-2021-30682 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Saf…
-
Unscored —CVE-2021-30731 Public exploit
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-004 Cata…
-
Critical 9.8
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…
KEV Nov 3, 2021 -
Unscored —CVE-2021-33831 Public exploit
api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Cont…
-
Unscored —
Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and open…
-
Medium 6.3CVE-2021-24006 Public exploit
An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker wi…
-
Medium 6.5CVE-2021-25735 Public exploit
Validating Admission Webhook does not observe some previous fields
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at leas…
-
Unscored —CVE-2021-40492 Public exploit
A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrar…
-
Medium 5.3
Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but determinist…
-
High 7.8CVE-2021-21086 Public exploit
Adobe Reader CoolType Arbitrary Stack Manipulation
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulne…
-
Unscored —CVE-2021-31796 Public exploit
An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information D…
-
High 7.2CVE-2021-39115 Public exploit
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Adminis…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 do…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and se…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allow…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi all…
-
Unscored —
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/kill…
-
High 8.9
ActionPluginBaseView Deserialization of Untrusted Data RCE
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.
-
Unscored —CVE-2021-39379 Public exploit
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A m…
-
Unscored —CVE-2021-39377 Public exploit
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A m…
-
Unscored —
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A m…
-
Unscored —CVE-2021-40352 Public exploit
OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can r…
-
Unscored —CVE-2021-40353 Public exploit
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application databas…
-
High 7.5
ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure
The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.
-
High 7.5CVE-2021-3749 Public exploit
Inefficient Regular Expression Complexity in axios/axios
axios is vulnerable to Inefficient Regular Expression Complexity
-
Unscored —
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFileP…
-
Unscored —CVE-2021-36981 Public exploit
In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to …
-
Critical 9.8
Booster for WooCommerce <= 5.4.3 Authentication Bypass
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function …
-
Unscored —CVE-2021-24581 Public exploit
Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)
The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settin…
-
Critical 9.8
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…
KEV Nov 3, 2021 -
High 8.8CVE-2021-39174 Public exploit
Configuration leak
Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various pas…
-
High 8.8
New line injection during configuration edition
Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execut…
-
High 8.1
Unauthenticated SQL Injection
Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the da…
-
High 8.2
Account Takeover in Octobercms
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been pat…
KEV Jan 18, 2022 -
High 8.1CVE-2021-39156 Public exploit
Fragments in Path May Lead to Authorization Policy Bypass
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitabl…
-
Unscored —CVE-2021-30956 Public exploit
A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state managem…