Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 408,894
Last 24h: 2,036
Critical, 7 days: 357
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,125 results · Clear filters · Feed

High 7.8

CVE-2021-34486 Exploited Public exploit

Windows Event Tracing Elevation of Privilege Vulnerability

Windows Event Tracing Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Aug 12, 2021
KEV Mar 28, 2022
Medium 5.3

CVE-2021-26085 Exploited · Ransomware Public exploit EPSS 100%

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…

Atlassian Confluence Server Confluence Data Center Web / CMS

Aug 3, 2021
KEV Mar 28, 2022
Critical 9.8

CVE-2021-35464 Exploited · Ransomware Public exploit EPSS 100%

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…

Jul 22, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-36934 Exploited Public exploit EPSS 67%

Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbit…

Microsoft Windows 10 Version 1809 Windows 10 Version 20H2 Windows 10 Version 1909 Windows

Jul 22, 2021
KEV Feb 10, 2022
Critical 9.0

CVE-2021-35211 Exploited · Ransomware Public exploit EPSS 91%

Serv-U Remote Memory Escape Vulnerability

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…

SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP

Jul 14, 2021
KEV Nov 3, 2021
Critical 9.0

CVE-2021-34523 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8

Jul 14, 2021
KEV Nov 3, 2021
Critical 9.1

CVE-2021-34473 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19

Jul 14, 2021
KEV Nov 3, 2021
High 7.3

CVE-2021-33766 Exploited Public exploit EPSS 98%

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19

Jul 14, 2021
KEV Jan 18, 2022
High 8.3

CVE-2021-22555 Exploited Public exploit EPSS 79%

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Jul 7, 2021
KEV Oct 6, 2025
High 8.8

CVE-2021-34527 Exploited · Ransomware Public exploit EPSS 100%

Windows Print Spooler Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could th…

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jul 2, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-30551 Exploited Public exploit EPSS 65%

Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corr…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jun 15, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-26828 Exploited Public exploit EPSS 39%

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and ex…

Jun 11, 2021
KEV Dec 3, 2025
High 8.4

CVE-2021-33739 Exploited Public exploit

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 20H2 Windows 10 Version 1909 Windows Server version 20H2 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 5.5

CVE-2021-31955 Exploited Public exploit EPSS 81%

Windows Kernel Information Disclosure Vulnerability

Windows Kernel Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-31956 Exploited Public exploit EPSS 22%

Windows NTFS Elevation of Privilege Vulnerability

Windows NTFS Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-1675 Exploited · Ransomware Public exploit EPSS 85%

Windows Print Spooler Remote Code Execution Vulnerability

Windows Print Spooler Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-21985 Exploited · Ransomware Public exploit EPSS 100%

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

Virtualization

May 26, 2021
KEV Nov 3, 2021
Medium 6.6

CVE-2021-31207 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8

May 11, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-31166 Exploited Public exploit EPSS 100%

HTTP Protocol Stack Remote Code Execution Vulnerability

HTTP Protocol Stack Remote Code Execution Vulnerability

Microsoft Windows 10 Version 20H2 Windows Server version 20H2 Windows 10 Version 2004 Windows

May 11, 2021
KEV Apr 6, 2022
High 8.8

CVE-2021-28664 Exploited Public exploit

The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unpriv…

May 10, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-28663 Exploited Public exploit EPSS 12%

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …

May 10, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-1498 Exploited Public exploit EPSS 100%

Cisco HyperFlex HX Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

Cisco Cisco HyperFlex HX Data Platform Network devices

May 6, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-1497 Exploited Public exploit EPSS 100%

Cisco HyperFlex HX Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

Cisco Cisco HyperFlex HX Data Platform Network devices

May 6, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-21551 Exploited Public exploit EPSS 80%

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privil…

Dell dbutil

May 4, 2021
KEV Mar 31, 2022
High 8.8

CVE-2021-21220 Exploited Public exploit EPSS 70%

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Apr 26, 2021
KEV Nov 3, 2021
Critical 10.0

CVE-2021-22205 Exploited · Ransomware Public exploit EPSS 100%

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

GitLab GitLab gitlab Web / CMS Ubuntu

Apr 23, 2021
KEV Nov 3, 2021
Medium 6.8

CVE-2021-22204 Exploited Public exploit EPSS 100%

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…

ExifTool ExifTool libimage-exiftool-perl libimage-exiftool-perl Debian Ubuntu Alpine

Apr 23, 2021
KEV Nov 17, 2021
Critical 10.0

CVE-2021-22893 Exploited · Ransomware Public exploit EPSS 48%

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

Apr 23, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-3493 Exploited Public exploit EPSS 49%

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting …

Ubuntu Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Apr 17, 2021
KEV Oct 20, 2022
Critical 9.8

CVE-2020-2509 Exploited Public exploit EPSS 34%

Command Injection Vulnerability in QTS and QuTS hero

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: …

QNAP Systems QTS QuTS hero

Apr 17, 2021
KEV Apr 11, 2022
High 7.8

CVE-2021-28310 Exploited Public exploit

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Apr 13, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-20021 Exploited · Ransomware Public exploit EPSS 89%

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

SonicWall Email Security Network devices

Apr 9, 2021
KEV Nov 3, 2021
High 7.0

CVE-2021-1782 Exploited Public exploit

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…

Apple macOS iOS and iPadOS macOS iOS

Apr 2, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-21975 Exploited · Ransomware Public exploit EPSS 78%

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious acto…

Mar 31, 2021
KEV Jan 18, 2022
Critical 9.8

CVE-2021-22986 Exploited · Ransomware Public exploit EPSS 100%

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…

Mar 31, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-21193 Exploited Public exploit

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Mar 16, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-26411 Exploited · Ransomware Public exploit EPSS 82%

Internet Explorer Memory Corruption Vulnerability

Internet Explorer Memory Corruption Vulnerability

Microsoft Internet Explorer 11 Internet Explorer 9 Microsoft Edge (EdgeHTML-based) Browsers

Mar 11, 2021
KEV Nov 3, 2021
Medium 4.4

CVE-2021-25337 Exploited Public exploit

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…

Samsung Mobile Samsung Mobile Devices

Mar 4, 2021
KEV Nov 8, 2022
Critical 9.8

CVE-2021-22681 Exploited Public exploit EPSS 64%

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…

Mar 3, 2021
KEV Mar 5, 2026
High 7.8

CVE-2021-27065 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8

Mar 2, 2021
KEV Nov 3, 2021

Latest vulnerabilities

Windows Event Tracing Elevation of Privilege Vulnerability

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…

Windows Elevation of Privilege Vulnerability

Serv-U Remote Memory Escape Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Information Disclosure Vulnerability

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

Windows Print Spooler Remote Code Execution Vulnerability

Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corr…

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and ex…

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Windows Kernel Information Disclosure Vulnerability

Windows NTFS Elevation of Privilege Vulnerability

Windows Print Spooler Remote Code Execution Vulnerability

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

Microsoft Exchange Server Security Feature Bypass Vulnerability

HTTP Protocol Stack Remote Code Execution Vulnerability

The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unpriv…

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …

Cisco HyperFlex HX Command Injection Vulnerabilities

Cisco HyperFlex HX Command Injection Vulnerabilities

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privil…

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting …

Command Injection Vulnerability in QTS and QuTS hero

Win32k Elevation of Privilege Vulnerability

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious acto…

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…

Internet Explorer Memory Corruption Vulnerability

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…

Microsoft Exchange Server Remote Code Execution Vulnerability