Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,922
- Last 24h
- 2,057
- Critical, 7 days
- 356
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
Medium 5.4
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Sep 10, 2024 -
High 7.8CVE-2024-38014 Exploited
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
KEV Sep 10, 2024 -
Critical 9.8
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…
KEV Oct 17, 2024 -
Critical 9.8
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an …
KEV Mar 31, 2025 -
Critical 9.8
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
KEV Feb 4, 2025 -
Critical 9.8
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
KEV Sep 16, 2024 -
Critical 9.3
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially le…
KEV Sep 9, 2024 -
Medium 6.6CVE-2024-39717 Exploited
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only ava…
KEV Aug 23, 2024 -
Critical 9.1
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
KEV Oct 15, 2024 -
High 8.8
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a…
KEV Aug 26, 2024 -
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exp…
KEV Aug 28, 2024 -
Critical 9.3CVE-2024-7262 Exploited
Arbitrary Code Execution in WPS Office
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-clic…
KEV Sep 3, 2024 -
Critical 9.8
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, Sola…
KEV Aug 15, 2024 -
Critical 9.8
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a rem…
KEV Sep 24, 2024 -
High 8.8CVE-2024-38189 Exploited
Microsoft Project Remote Code Execution Vulnerability
Microsoft Project Remote Code Execution Vulnerability
KEV Aug 13, 2024 -
High 7.8CVE-2024-38107 Exploited
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
KEV Aug 13, 2024 -
High 7.0CVE-2024-38106 Exploited
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
KEV Aug 13, 2024 -
Medium 6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Aug 13, 2024 -
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
KEV Aug 13, 2024 -
High 7.5
Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
KEV Aug 13, 2024 -
High 7.2CVE-2024-7694 Exploited
TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload
ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the s…
KEV Feb 17, 2026 -
Medium 6.1
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists i…
KEV May 19, 2025 -
Medium 6.8
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit,…
KEV Feb 12, 2025 -
High 8.8
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before …
KEV Apr 24, 2026 -
High 8.1
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of …
KEV Aug 27, 2024 -
Critical 9.3
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to ste…
KEV Jun 9, 2025 -
Critical 9.8
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastruc…
KEV Jul 29, 2024 -
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Jun 1, 2026 -
Critical 9.3
Expedition: Missing Authentication Leads to Admin Account Takeover
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichm…
KEV Nov 7, 2024 -
Critical 9.8
Incomplete Input Validation in GlideExpression Script
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now P…
KEV Jul 29, 2024 -
Critical 9.8
Jelly Template Injection Vulnerability in ServiceNow UI Macros
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. Servi…
KEV Jul 29, 2024 -
High 7.2
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft SharePoint Remote Code Execution Vulnerability
KEV Oct 22, 2024 -
High 7.5
Windows MSHTML Platform Spoofing Vulnerability
Windows MSHTML Platform Spoofing Vulnerability
KEV Jul 9, 2024 -
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
KEV Jul 9, 2024 -
Medium 5.3CVE-2024-39891 Exploited
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoi…
KEV Jul 23, 2024 -
Critical 9.1
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…
KEV May 1, 2025 -
Medium 6.0
Cisco NX-OS Software CLI Command Injection Vulnerability
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insuff…
KEV Jul 2, 2024 -
Critical 9.8
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted …
KEV Jul 15, 2024 -
Critical 9.8
WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
KEV Mar 3, 2025 -
Medium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…
KEV Jul 30, 2024