Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,702
- Last 24h
- 358
- Critical, 7 days
- 343
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Unscored —
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow …
-
High 7.5CVE-2020-35498 Public exploit
A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a ma…
-
Unscored —
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending…
-
Unscored —CVE-2021-0325 Public exploit
In ih264d_parse_pslice of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow.…
-
Unscored —CVE-2021-0326 Public exploit
In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lea…
-
Unscored —CVE-2021-0327 Public exploit
In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored bin…
-
Unscored —CVE-2021-0328 Public exploit
In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan resu…
-
Unscored —CVE-2021-0329 Public exploit
In several native functions called by AdvertiseManager.java, there is a possible out of bounds write due to a missing b…
-
Unscored —CVE-2021-0314 Public exploit
In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a …
-
Unscored —CVE-2021-0330 Public exploit
In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This cou…
-
Unscored —CVE-2021-0331 Public exploit
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure defau…
-
Unscored —CVE-2021-0332 Public exploit
In bootFinished of SurfaceFlinger.cpp, there is a possible memory corruption due to a use after free. This could lead t…
-
Unscored —CVE-2021-0333 Public exploit
In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay tha…
-
Unscored —CVE-2021-0334 Public exploit
In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default…
-
Unscored —CVE-2021-0336 Public exploit
In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent.…
-
Unscored —CVE-2021-0337 Public exploit
In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lea…
-
Unscored —CVE-2021-0302 Public exploit
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —CVE-2021-0339 Public exploit
In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app…
-
Unscored —CVE-2021-0340 Public exploit
In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input…
-
Unscored —
Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the …
-
High 8.8
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit hea…
KEV Nov 3, 2021 -
Unscored —CVE-2021-3394 Public exploit
Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder pe…
-
Unscored —
Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to byp…
-
Unscored —CVE-2020-22841 Public exploit
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code executio…
-
Critical 9.8CVE-2020-14343 Public exploit
Improper Input Validation in PyYAML
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the libra…
-
Unscored —CVE-2021-3294 Public exploit
CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a c…
-
Critical 9.8
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. Th…
KEV Nov 3, 2021 -
Unscored —
NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code…
-
Unscored —CVE-2021-25837 Public exploit
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsist…
-
Unscored —
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (wi…
-
Unscored —CVE-2021-26708 Public exploit
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOC…
-
Unscored —CVE-2020-18724 Public exploit
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 1…
-
Unscored —CVE-2020-18723 Public exploit
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code…
-
Critical 9.8
Authentication bypass in Apache Shiro
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
-
Unscored —
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution …
-
Unscored —CVE-2020-35667 Public exploit
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
-
Unscored —CVE-2020-24490 Public exploit
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adj…
-
Unscored —CVE-2021-3395 Public exploit
A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary …
-
Medium 5.3CVE-2021-3281 Public exploit
Django Directory Traversal via archive.extract
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with do…
-
Unscored —
FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUp…