Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 408,817
Last 24h: 2,072
Critical, 7 days: 349
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,125 results · Clear filters · Feed

High 7.5

CVE-2023-21839 Exploited Public exploit EPSS 100%

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

Oracle WebLogic Server

Jan 17, 2023
KEV May 1, 2023
High 8.8

CVE-2023-22952 Exploited Public exploit EPSS 80%

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because …

Jan 11, 2023
KEV Feb 2, 2023
High 8.8

CVE-2023-21674 Exploited Public exploit EPSS 34%

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 10, 2023
KEV Jan 10, 2023
Critical 9.8

CVE-2022-44877 Exploited Public exploit EPSS 100%

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execu…

Jan 5, 2023
KEV Jan 17, 2023
Critical 9.3

CVE-2022-42475 Exploited · Ransomware Public exploit EPSS 99%

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…

Fortinet FortiOS FortiProxy Network devices

Jan 2, 2023
KEV Dec 13, 2022
High 8.8

CVE-2022-26485 Exploited Public exploit EPSS 14%

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022
KEV Mar 7, 2022
Critical 9.8

CVE-2022-27518 Exploited Public exploit

Unauthenticated remote arbitrary code execution

Unauthenticated remote arbitrary code execution

Citrix Citrix Gateway, Citrix ADC Network devices

Dec 13, 2022
KEV Dec 13, 2022
Critical 9.8

CVE-2022-46169 Exploited Public exploit EPSS 100%

Unauthenticated Command Injection

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

Cacti cacti cacti cacti Debian Ubuntu

Dec 5, 2022
KEV Feb 16, 2023
High 8.8

CVE-2022-4262 Exploited Public exploit EPSS 24%

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Dec 2, 2022
KEV Dec 5, 2022
High 8.8

CVE-2022-41080 Exploited · Ransomware Public exploit EPSS 77%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Nov 9, 2022
KEV Jan 10, 2023
Critical 9.8

CVE-2022-31199 Exploited · Ransomware Public exploit EPSS 36%

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…

Nov 8, 2022
KEV Jul 11, 2023
High 8.8

CVE-2022-38181 Exploited Public exploit EPSS 18%

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…

Oct 25, 2022
KEV Mar 30, 2023
Critical 9.8

CVE-2016-20017 Exploited Public exploit EPSS 66%

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…

Oct 19, 2022
KEV Jan 8, 2024
Critical 9.8

CVE-2022-40684 Exploited · Ransomware Public exploit EPSS 100%

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Network devices

Oct 18, 2022
KEV Oct 11, 2022
Critical 9.8

CVE-2022-21587 Exploited · Ransomware Public exploit EPSS 98%

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

Oracle Web Applications Desktop Integrator

Oct 18, 2022
KEV Feb 2, 2023
High 8.8

CVE-2022-41040 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Oct 3, 2022
KEV Sep 30, 2022
High 8.0

CVE-2022-41082 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Oct 3, 2022
KEV Sep 30, 2022
Critical 9.8

CVE-2022-41352 Exploited · Ransomware Public exploit EPSS 95%

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

Sep 26, 2022
KEV Oct 20, 2022
Medium 6.1

CVE-2022-39197 Exploited Public exploit EPSS 44%

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…

Sep 22, 2022
KEV Mar 30, 2023
Critical 9.8

CVE-2022-35914 Exploited Public exploit EPSS 100%

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Sep 19, 2022
KEV Mar 7, 2023
High 7.8

CVE-2022-37969 Exploited · Ransomware Public exploit EPSS 28%

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Sep 13, 2022
KEV Sep 14, 2022
High 7.5

CVE-2022-36537 Exploited · Ransomware Public exploit EPSS 95%

ZK Framework vulnerable to malicious POST

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

org.zkoss.zk:zk Maven

Aug 26, 2022
KEV Feb 27, 2023
High 8.8

CVE-2022-36804 Exploited Public exploit EPSS 99%

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…

Atlassian Bitbucket Server Bitbucket Data Center

Aug 25, 2022
KEV Sep 30, 2022
Critical 9.8

CVE-2022-37042 Exploited · Ransomware Public exploit EPSS 92%

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts f…

Aug 11, 2022
KEV Aug 11, 2022
High 8.8

CVE-2022-1364 Exploited Public exploit EPSS 14%

Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jul 26, 2022
KEV Apr 15, 2022
High 8.8

CVE-2022-1096 Exploited Public exploit EPSS 25%

Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corru…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jul 22, 2022
KEV Mar 28, 2022
Critical 9.8

CVE-2022-26138 Exploited Public exploit EPSS 98%

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…

Atlassian Questions For Confluence Web / CMS

Jul 20, 2022
KEV Jul 29, 2022
Critical 9.8

CVE-2022-35405 Exploited Public exploit EPSS 100%

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…

Jul 19, 2022
KEV Sep 22, 2022
High 8.8

CVE-2022-33891 Exploited Public exploit EPSS 93%

Apache Spark shell command injection vulnerability via Spark UI

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…

Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.12 Maven PyPI

Jul 18, 2022
KEV Mar 7, 2023
Critical 9.8

CVE-2022-26352 Exploited · Ransomware Public exploit EPSS 91%

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form re…

Jul 17, 2022
KEV Aug 25, 2022
Critical 9.8

CVE-2022-26134 Exploited · Ransomware Public exploit EPSS 100%

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

Atlassian Confluence Data Center Confluence Server Web / CMS

Jun 3, 2022
KEV Jun 2, 2022
High 7.8

CVE-2022-30190 Exploited · Ransomware Public exploit EPSS 99%

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. Th…

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 1, 2022
KEV Jun 14, 2022
Critical 9.8

CVE-2022-29303 Exploited Public exploit EPSS 98%

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

May 12, 2022
KEV Jul 13, 2023
Critical 9.8

CVE-2022-30525 Exploited Public exploit EPSS 100%

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…

Zyxel ATP series firmware VPN series Firmware USG FLEX 50(W) firmware Network devices

May 12, 2022
KEV May 16, 2022
High 8.8

CVE-2022-26923 Exploited Public exploit EPSS 84%

Active Directory Domain Services Elevation of Privilege Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

May 10, 2022
KEV Aug 18, 2022
Critical 9.8

CVE-2022-30333 Exploited · Ransomware Public exploit EPSS 99%

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …

unrar-nonfree unrar-nonfree rar libclamunrar Debian Ubuntu

May 9, 2022
KEV Aug 9, 2022
Critical 9.8

CVE-2022-1388 Exploited · Ransomware Public exploit EPSS 100%

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

F5 BIG-IP Network devices

May 5, 2022
KEV May 10, 2022
Critical 9.8

CVE-2022-24706 Exploited Public exploit EPSS 93%

Remote Code Execution Vulnerability in Packaging

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including re…

Apache Software Foundation Apache CouchDB

Apr 26, 2022
KEV Aug 25, 2022
High 7.2

CVE-2022-27925 Exploited · Ransomware Public exploit EPSS 99%

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts fil…

Apr 20, 2022
KEV Aug 11, 2022
Critical 9.8

CVE-2022-21445 Exploited Public exploit EPSS 62%

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…

Oracle Application Development Framework (ADF)

Apr 19, 2022
KEV Sep 18, 2024

Latest vulnerabilities

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because …

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execu…

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

Unauthenticated remote arbitrary code execution

Unauthenticated Command Injection

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

Microsoft Exchange Server Elevation of Privilege Vulnerability

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Windows Common Log File System Driver Elevation of Privilege Vulnerability

ZK Framework vulnerable to malicious POST

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts f…

Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…

Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corru…

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…

Apache Spark shell command injection vulnerability via Spark UI

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form re…

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pa…

Active Directory Domain Services Elevation of Privilege Vulnerability

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…

Remote Code Execution Vulnerability in Packaging

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts fil…

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…