Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,687
- Last 24h
- 434
- Critical, 7 days
- 343
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
High 8.4
Twig allowing dangerous PHP functions by default
Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code executio…
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
Critical 9.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
Low 3.3CVE-2021-28312 Public exploit
Windows NTFS Denial of Service Vulnerability
Windows NTFS Denial of Service Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 7.8CVE-2021-26415 Public exploit
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
Unscored —CVE-2021-0437 Public exploit
In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in…
-
Unscored —CVE-2021-0435 Public exploit
In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could…
-
Unscored —CVE-2021-0431 Public exploit
In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Unscored —CVE-2021-0433 Public exploit
In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth devi…
-
High 8.0CVE-2021-29427 Public exploit
Repository content filters do not work in Settings pluginManagement
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are u…
-
Unscored —CVE-2021-25253 Public exploit
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG S…
-
Medium 6.5
Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…
-
High 7.1
SSRF vulnerability with the Replication handler
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the loc…
-
Unscored —
Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacte…
-
Unscored —CVE-2021-30637 Public exploit
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
-
Unscored —CVE-2021-30030 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
-
Unscored —CVE-2021-30034 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
-
Unscored —CVE-2021-30044 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
-
Unscored —CVE-2021-30042 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Con…
-
Unscored —CVE-2021-30039 Public exploit
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-rep…
-
Medium 5.6CVE-2021-23369 Public exploit
Remote Code Execution (RCE)
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
-
Unscored —CVE-2021-28879 Public exploit
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ov…
-
High 8.0CVE-2021-30481 Public exploit
Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arb…
-
Critical 9.8
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…
KEV Nov 3, 2021 -
High 8.6CVE-2021-25374 Public exploit
An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in…
-
Unscored —CVE-2020-36287 Public exploit
The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center befo…
-
High 7.8CVE-2021-1480 Public exploit
Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these …
-
Medium 5.3
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about thes…
-
Medium 5.3
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about thes…
-
Critical 9.3
Unauthenticated Arbitrary YAML Write/Update leads to Code Execution
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Partic…
-
Unscored —CVE-2021-29627 Public exploit
In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, list…
-
Unscored —CVE-2021-30147 Public exploit
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
-
Medium 6.8CVE-2021-21423 Public exploit
Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen
`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `Node…
-
Unscored —CVE-2021-24027 Public exploit
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may h…
-
Unscored —CVE-2021-30146 Public exploit
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
-
Unscored —CVE-2021-28142 Public exploit
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."
-
Unscored —
Composr 10.0.36 allows upload and execution of PHP files.
-
Unscored —CVE-2021-30150 Public exploit
Composr 10.0.36 allows XSS in an XML script.
-
Unscored —CVE-2021-24174 Public exploit
Database Backups <= 1.2.2.6 - CSRF to Backup Download
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.