Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,693
- Last 24h
- 433
- Critical, 7 days
- 343
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
High 7.8CVE-2021-24096 Public exploit
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.8CVE-2021-24092 Public exploit
Microsoft Defender Elevation of Privilege Vulnerability
Microsoft Defender Elevation of Privilege Vulnerability
-
High 7.5
Windows TCP/IP Denial of Service Vulnerability
Windows TCP/IP Denial of Service Vulnerability
-
Medium 6.5CVE-2021-24085 Public exploit
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
-
Medium 5.5CVE-2021-24084 Public exploit
Windows Mobile Device Management Information Disclosure Vulnerability
Windows Mobile Device Management Information Disclosure Vulnerability
-
High 7.8
Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 8.8
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-S…
-
Critical 9.8
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor…
KEV Nov 3, 2021 -
Medium 5.3
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…
KEV Mar 7, 2022 -
Unscored —CVE-2021-3355 Public exploit
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Ti…
-
Unscored —CVE-2020-12702 Public exploit
Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iO…
-
Medium 5.9CVE-2021-27568 Public exploit
Improper Check for Unusual or Exceptional Conditions in json-smart
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the l…
-
Unscored —CVE-2021-27370 Public exploit
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
-
Unscored —
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files beca…
-
Unscored —CVE-2021-27328 Public exploit
Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware …
-
Unscored —CVE-2021-27403 Public exploit
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.
-
Unscored —CVE-2021-27404 Public exploit
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.
-
Unscored —
OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_s…
-
High 7.8CVE-2021-1366 Public exploit
Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is…
-
Critical 9.8
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…
KEV Nov 3, 2021 -
High 7.1
Command Injection Vulnerability
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerabili…
KEV Jan 18, 2022 -
High 7.5
Integer overflow in CipherUpdate
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …
-
Medium 5.9CVE-2021-23841 Public exploit
Null pointer deref in X509_issuer_and_serial_hash()
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …
-
High 7.2
Zip slip in Microweber
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an adminis…
-
Unscored —CVE-2021-27211 Public exploit
steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.
-
Unscored —
CITSmart before 9.1.2.23 allows LDAP Injection.
-
High 7.2
Command Injection
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
-
High 8.8
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…
KEV Jan 18, 2022 -
High 8.8
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…
KEV Jan 18, 2022 -
High 8.8
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosx…
KEV Jan 18, 2022 -
Unscored —CVE-2021-26929 Public exploit
An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library befo…
-
Unscored —CVE-2021-27188 Public exploit
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (acce…
-
Unscored —CVE-2021-27187 Public exploit
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in l…
-
Unscored —CVE-2021-27190 Public exploit
A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly av…
-
High 7.2
SSRF in adminer
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is …
KEV Sep 29, 2025 -
Critical 9.1CVE-2021-21014 Public exploit
Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console i…
-
Medium 6.5
Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability
Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to arbitrary disclosure of information in the memory stack. An attacker …
-
High 8.8
Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achiev…
KEV Nov 3, 2021 -
High 8.6
Remote Code Exploit in Lucee Admin
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.…
-
High 7.5CVE-2021-22880 Public exploit
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active …