Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,653
- Last 24h
- 539
- Critical, 7 days
- 344
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —CVE-2021-30955 Public exploit
A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, i…
-
Unscored —
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Big Sur 11.6.2, tvO…
-
Unscored —CVE-2021-30862 Public exploit
A validation issue was addressed with improved input sanitization. This issue is fixed in iTunes U 3.8.3. Processing a …
-
High 7.8
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catal…
KEV Nov 3, 2021 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, …
KEV Nov 3, 2021 -
Unscored —CVE-2021-30853 Public exploit
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6. A malicious application may b…
-
High 7.4
Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…
-
Critical 9.8
SM2 Decryption Buffer Overflow
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" paramet…
-
Unscored —
Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a re…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
XStream is vulnerable to a Remote Command Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affec…
KEV Mar 10, 2023 -
Unscored —CVE-2021-39273 Public exploit
In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an …
-
Critical 9.8
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability
A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resu…
-
Unscored —CVE-2021-0640 Public exploit
In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check. This could…
-
Unscored —CVE-2021-0519 Public exploit
In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow. This c…
-
Unscored —CVE-2021-3707 Public exploit
D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modificatio…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path t…
KEV Nov 12, 2024 -
Unscored —CVE-2021-38699 Public exploit
TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.
-
Unscored —CVE-2021-38619 Public exploit
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can condu…
-
Unscored —CVE-2021-38583 Public exploit
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting …
-
Unscored —
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post a…
-
Critical 9.3CVE-2021-37678 Public exploit
Arbitrary code execution due to YAML deserialization
TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The [implementation](https://github.com/tens…
-
Unscored —CVE-2021-38603 Public exploit
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
-
Unscored —CVE-2021-38602 Public exploit
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
-
High 7.1CVE-2021-36949 Public exploit
Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability
Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability
-
High 7.5
Windows LSA Spoofing Vulnerability
Windows LSA Spoofing Vulnerability
KEV Nov 3, 2021 -
High 7.8
Windows Event Tracing Elevation of Privilege Vulnerability
Windows Event Tracing Elevation of Privilege Vulnerability
KEV Mar 28, 2022 -
Unscored —CVE-2021-38085 Public exploit
The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer pr…
-
Unscored —
Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workf…
-
Unscored —CVE-2021-37391 Public exploit
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrato…
-
High 7.6CVE-2021-33699 Public exploit
Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in…
-
Unscored —
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the abil…
-
Unscored —CVE-2021-36798 Public exploit
A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allo…
-
Unscored —
Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) befo…
-
Unscored —
Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbi…
-
High 7.8CVE-2021-38185 Public exploit
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_…
-
Unscored —CVE-2021-35312 Public exploit
A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Ser…
-
Unscored —CVE-2021-38149 Public exploit
index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.
-
Low 3.7CVE-2021-22924 Public exploit
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…
-
Unscored —CVE-2021-3679 Public exploit
A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the …