Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,922
- Last 24h
- 2,059
- Critical, 7 days
- 356
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
High 7.8CVE-2025-21418 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
KEV Feb 11, 2025 -
High 7.1CVE-2025-21391 Exploited
Windows Storage Elevation of Privilege Vulnerability
Windows Storage Elevation of Privilege Vulnerability
KEV Feb 11, 2025 -
High 8.1
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0…
KEV Mar 18, 2025 -
Critical 9.9
Remote code execution in Wazuh server
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI param…
KEV Jun 10, 2025 -
Medium 6.1CVE-2025-24200 Exploited
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.…
KEV Feb 12, 2025 -
High 8.6
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable t…
KEV Feb 7, 2025 -
High 8.8
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the l…
KEV Feb 11, 2025 -
High 8.8
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DS…
KEV Feb 11, 2025 -
High 8.8
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affect…
KEV Dec 22, 2025 -
Critical 9.9
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., one…
KEV Mar 10, 2025 -
Medium 5.8
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to e…
KEV Mar 10, 2025 -
Critical 10.0
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, …
KEV Jan 29, 2025 -
High 7.0
7-Zip Mark-of-the-Web Bypass Vulnerability
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must vi…
KEV Feb 6, 2025 -
Critical 9.8
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Managem…
KEV Jan 24, 2025 -
High 8.1
Potential RCE with a compromised security key in craft/cms
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running…
KEV Feb 20, 2025 -
High 7.2
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file …
KEV Apr 24, 2026 -
Critical 9.1
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enab…
KEV Feb 13, 2025 -
Critical 9.9
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to crea…
KEV Apr 24, 2026 -
High 7.8CVE-2025-21334 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
High 7.8
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
High 7.8CVE-2025-21335 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
Critical 9.8
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…
KEV Mar 10, 2025 -
Critical 9.8
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…
KEV Mar 10, 2025 -
Critical 9.8
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…
KEV Mar 10, 2025 -
Critical 9.6
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thr…
KEV Jan 14, 2025 -
High 8.2
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…
KEV Feb 18, 2025 -
Critical 9.0
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.…
KEV Jan 8, 2025 -
Critical 10.0
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutraliz…
KEV Jan 16, 2025 -
High 7.3
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argu…
KEV May 15, 2025 -
High 7.8CVE-2024-53197 Exploited
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…
KEV Apr 9, 2025 -
High 7.1
PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger th…
KEV Dec 30, 2024 -
High 7.1CVE-2024-53150 Exploited
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, wh…
KEV Apr 9, 2025 -
Critical 9.3
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified…
KEV Jun 2, 2025 -
Medium 6.6
Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
KEV Jan 13, 2025 -
Critical 9.8
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
KEV Dec 19, 2024 -
Critical 9.8
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can imp…
KEV Dec 17, 2024 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Dec 10, 2024 -
Medium 4.4
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local f…
KEV Jan 7, 2025 -
High 7.8
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating …
KEV Feb 5, 2025 -
High 7.5CVE-2024-11667 Exploited · Ransomware
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through…
KEV Dec 3, 2024