Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,861
- Last 24h
- 2,003
- Critical, 7 days
- 356
- Known exploited
- 1,779
1,125 results · Clear filters · Feed
-
Critical 9.8
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execu…
KEV Mar 25, 2024 -
High 7.5
Grafana path traversal
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…
KEV Oct 9, 2025 -
High 8.1
Deserialization of Untrusted Data
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
KEV Aug 26, 2026 -
Critical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014…
KEV Dec 1, 2021 -
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially expl…
KEV Nov 3, 2021 -
Critical 9.8
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
KEV Jun 22, 2023 -
Critical 10.0
GeoJSON URL validation can expose server files and environment variables to unauthorized users
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…
KEV Nov 12, 2024 -
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 17, 2021 -
High 7.8
Microsoft Excel Security Feature Bypass Vulnerability
Microsoft Excel Security Feature Bypass Vulnerability
KEV Nov 17, 2021 -
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Apr 11, 2022 -
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Apr 11, 2022 -
Critical 9.8
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…
KEV Mar 25, 2022 -
Critical 9.8
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…
KEV Nov 3, 2021 -
High 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS…
KEV Nov 3, 2021 -
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
KEV Nov 17, 2021 -
High 8.8
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap …
KEV Nov 3, 2021 -
High 8.8
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corru…
KEV Nov 3, 2021 -
Critical 9.8
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…
KEV Nov 3, 2021 -
High 7.5
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…
KEV Nov 3, 2021 -
Critical 9.8
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…
KEV Mar 25, 2022 -
Critical 9.8
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…
KEV Nov 3, 2021 -
Critical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation…
KEV Jan 10, 2022 -
Critical 9.0
mod_proxy SSRF
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
KEV Dec 1, 2021 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
High 8.8
Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An a…
KEV Nov 3, 2021 -
High 7.8
Open Management Infrastructure Elevation of Privilege Vulnerability
Open Management Infrastructure Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.8
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.9
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…
KEV Jun 9, 2022 -
Critical 9.8
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous…
KEV Jan 18, 2022 -
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …
KEV Nov 3, 2021 -
Critical 9.8
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…
KEV Nov 3, 2021 -
Critical 9.8
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…
KEV Nov 3, 2021 -
High 8.2
Account Takeover in Octobercms
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been pat…
KEV Jan 18, 2022 -
High 7.8
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catal…
KEV Nov 3, 2021 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, …
KEV Nov 3, 2021 -
High 8.5
XStream is vulnerable to a Remote Command Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affec…
KEV Mar 10, 2023 -
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path t…
KEV Nov 12, 2024 -
High 7.5
Windows LSA Spoofing Vulnerability
Windows LSA Spoofing Vulnerability
KEV Nov 3, 2021