Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 408,922
Last 24h: 2,057
Critical, 7 days: 356
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,125 results · Clear filters · Feed

Critical 9.8

CVE-2019-17621 Exploited Public exploit EPSS 91%

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated re…

Dec 30, 2019
KEV Jun 29, 2023
High 7.5

CVE-2019-20085 Exploited Public exploit EPSS 96%

TVT NVMS-1000 devices allow GET /.. Directory Traversal

Dec 30, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-19781 Exploited · Ransomware Public exploit EPSS 100%

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. T…

Dec 27, 2019
KEV Nov 3, 2021
Critical 9.9

CVE-2019-10758 Exploited Public exploit EPSS 85%

Remote Code Execution Vulnerability in NPM mongo-express

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

mongo-express npm

Dec 24, 2019
KEV Dec 10, 2021
High 7.8

CVE-2019-8605 Exploited Public exploit EPSS 18%

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…

Apple macOS watchOS tvOS macOS iOS

Dec 18, 2019
KEV Jun 27, 2022
High 7.8

CVE-2019-7286 Exploited Public exploit EPSS 16%

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…

Apple macOS iOS macOS iOS

Dec 18, 2019
KEV May 23, 2022
High 8.8

CVE-2019-8506 Exploited Public exploit EPSS 16%

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…

Apple watchOS tvOS Safari Windows iOS Browsers Debian Ubuntu Alpine

Dec 18, 2019
KEV May 4, 2022
Critical 10.0

CVE-2019-4716 Exploited Public exploit EPSS 86%

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…

IBM Planning Analytics

Dec 18, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-18935 Exploited · Ransomware Public exploit EPSS 100%

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

Dec 11, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1458 Exploited · Ransomware Public exploit EPSS 74%

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

Microsoft Windows Windows Server Windows

Dec 10, 2019
KEV Jan 10, 2022
Critical 9.8

CVE-2019-5544 Exploited · Ransomware Public exploit EPSS 98%

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…

openslp-dfsg Virtualization Ubuntu

Dec 6, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-7195 Exploited · Ransomware Public exploit EPSS 89%

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

Dec 5, 2019
KEV Jun 8, 2022
Critical 9.8

CVE-2019-7194 Exploited · Ransomware Public exploit EPSS 83%

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

Dec 5, 2019
KEV Jun 8, 2022
Critical 9.8

CVE-2019-7192 Exploited · Ransomware Public exploit EPSS 88%

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…

Dec 5, 2019
KEV Jun 8, 2022
Medium 6.5

CVE-2019-5825 Exploited Public exploit EPSS 56%

Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 25, 2019
KEV Jun 8, 2022
High 8.8

CVE-2019-13720 Exploited Public exploit EPSS 49%

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 25, 2019
KEV May 23, 2022
Medium 6.5

CVE-2019-6693 Exploited · Ransomware Public exploit

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attack…

Fortinet FortiGate Network devices

Nov 21, 2019
KEV Jun 25, 2025
High 7.5

CVE-2019-1429 Exploited Public exploit EPSS 77%

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

Microsoft Internet Explorer 11 Internet Explorer 9 Internet Explorer 10 Windows

Nov 12, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1405 Exploited · Ransomware Public exploit EPSS 30%

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allow…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Nov 12, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1388 Exploited · Ransomware Public exploit

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Nov 12, 2019
KEV Apr 7, 2023
High 8.7

CVE-2019-11043 Exploited · Ransomware Public exploit EPSS 100%

Underflow in PHP-FPM can lead to RCE

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibilit…

php php php5 php7.0 Ubuntu Alpine

Oct 28, 2019
KEV Mar 25, 2022
High 8.8

CVE-2019-3010 Exploited Public exploit EPSS 14%

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is …

Oracle Solaris Operating System

Oct 16, 2019
KEV May 25, 2022
Critical 9.8

CVE-2019-16278 Exploited Public exploit EPSS 99%

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…

Oct 14, 2019
KEV Nov 7, 2024
High 7.8

CVE-2019-2215 Exploited Public exploit EPSS 72%

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interact…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Oct 11, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1322 Exploited · Ransomware Public exploit EPSS 19%

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Oct 10, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1315 Exploited · Ransomware Public exploit

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Oct 10, 2019
KEV Mar 15, 2022
Critical 9.8

CVE-2019-16920 Exploited Public exploit EPSS 100%

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The …

Sep 27, 2019
KEV Mar 25, 2022
Critical 9.8

CVE-2019-16759 Exploited Public exploit EPSS 100%

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widg…

Sep 24, 2019
KEV Nov 3, 2021
High 7.5

CVE-2019-1367 Exploited · Ransomware Public exploit EPSS 52%

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

Microsoft Internet Explorer 11 Internet Explorer 9 Internet Explorer 10 Windows

Sep 23, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1253 Exploited · Ransomware Public exploit EPSS 12%

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Sep 11, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1215 Exploited · Ransomware Public exploit EPSS 19%

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Wi…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Sep 11, 2019
KEV Nov 3, 2021
High 8.8

CVE-2019-15949 Exploited Public exploit EPSS 77%

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios…

Sep 5, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-15752 Exploited Public exploit EPSS 49%

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-…

Aug 28, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-15107 Exploited · Ransomware Public exploit EPSS 100%

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…

Aug 16, 2019
KEV Mar 25, 2022
Critical 9.8

CVE-2019-11581 Exploited Public exploit EPSS 85%

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

Atlassian Jira Server and Data Center Web / CMS

Aug 9, 2019
KEV Mar 7, 2022
High 7.2

CVE-2019-0193 Exploited Public exploit EPSS 84%

XML External Entity (XXE) Injection in Apache Solr

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen…

Apache Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven

Aug 1, 2019
KEV Dec 10, 2021
High 7.8

CVE-2019-1132 Exploited Public exploit

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

Microsoft Windows Windows Server Windows

Jul 29, 2019
KEV Mar 15, 2022
High 8.8

CVE-2019-11707 Exploited Public exploit EPSS 38%

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jul 23, 2019
KEV May 23, 2022
Critical 10.0

CVE-2019-11708 Exploited Public exploit EPSS 56%

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jul 23, 2019
KEV May 23, 2022
High 8.1

CVE-2019-1579 Exploited · Ransomware Public exploit EPSS 44%

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…

Jul 19, 2019
KEV Jan 10, 2022

Latest vulnerabilities

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated re…

TVT NVMS-1000 devices allow GET /.. Directory Traversal

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. T…

Remote Code Execution Vulnerability in NPM mongo-express

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…

Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attack…

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allow…

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user…

Underflow in PHP-FPM can lead to RCE

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is …

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interact…

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft …

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The …

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widg…

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Wi…

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios…

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-…

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

XML External Entity (XXE) Injection in Apache Solr

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…