Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,728
- Last 24h
- 377
- Critical, 7 days
- 343
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Critical 9.8
Improper Authentication in InfluxDB
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
-
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…
-
Unscored —CVE-2020-12593 Public exploit
Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a…
-
Unscored —CVE-2020-28091 Public exploit
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords param…
-
Unscored —CVE-2020-28092 Public exploit
PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&…
-
Unscored —CVE-2020-25988 Public exploit
UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' w…
-
Unscored —CVE-2020-13958 Public exploit
A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks p…
-
Unscored —
The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to up…
-
Unscored —
The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upl…
-
Unscored —CVE-2020-28647 Public exploit
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If …
-
Unscored —CVE-2020-15349 Public exploit
BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool …
-
Unscored —CVE-2020-25705 Public exploit
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an of…
-
Unscored —CVE-2020-11851 Public exploit
Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. Th…
-
High 8.0
Remote Code Execution in XStream
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XS…
-
High 8.8CVE-2020-23489 Public exploit
AVideo vulnerable to Improper Privilege Management
The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
-
Unscored —CVE-2020-27422 Public exploit
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an …
-
Unscored —CVE-2020-27423 Public exploit
Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial …
-
Unscored —CVE-2020-25557 Public exploit
In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. …
-
Unscored —CVE-2020-25538 Public exploit
An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and …
-
Unscored —
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done b…
-
Unscored —CVE-2020-28414 Public exploit
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unaut…
-
Unscored —CVE-2020-28415 Public exploit
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unaut…
-
Unscored —
An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and …
-
Unscored —CVE-2020-8694 Public exploit
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to …
-
High 8.0CVE-2020-26218 Public exploit
HTML Injection in touchbase.ai
touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0.
-
High 7.8
Windows Kernel Local Elevation of Privilege Vulnerability
Windows Kernel Local Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 7.8CVE-2020-17086 Public exploit
Raw Image Extension Remote Code Execution Vulnerability
Raw Image Extension Remote Code Execution Vulnerability
-
High 7.0CVE-2020-17057 Public exploit
Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
-
High 7.8CVE-2020-17035 Public exploit
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
Low 3.3CVE-2020-16126 Public exploit
accountsservice drops ruid, allows unprivileged users to send it signals
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a…
-
High 8.8CVE-2019-7357 Public exploit
Subrion CMS CSRF Vulnerability
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.
-
Unscored —CVE-2020-23968 Public exploit
Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on Progra…
-
Unscored —CVE-2020-0453 Public exploit
In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent…
-
Unscored —CVE-2020-0452 Public exploit
In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could…
-
Unscored —CVE-2020-0451 Public exploit
In sbrDecoder_AssignQmfChannels2SbrChannels of sbrdecoder.cpp, there is a possible out of bounds write due to a heap bu…
-
Unscored —CVE-2020-0409 Public exploit
In create of FileMap.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local …
-
Unscored —CVE-2020-0418 Public exploit
In getPermissionInfosForGroup of Utils.java, there is a logic error. This could lead to local escalation of privilege w…
-
Unscored —CVE-2020-0443 Public exploit
In LocaleList of LocaleList.java, there is a possible forced reboot due to an uncaught exception. This could lead to lo…
-
Unscored —CVE-2020-0439 Public exploit
In generatePackageInfo of PackageManagerService.java, there is a possible permissions bypass due to an incorrect permis…
-
High 7.2CVE-2020-16125 Public exploit
gdm3 would start gnome-initial-setup if it cannot contact accountservice
gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a lo…