Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 408,988
Last 24h: 787
Critical, 7 days: 353
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,796 results · Clear filters · Feed

Medium 6.5

CVE-2023-28204 Exploited EPSS 14%

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macO…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 23, 2023
KEV May 22, 2023
High 7.8

CVE-2023-32434 Exploited Public exploit EPSS 58%

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 1…

Apple macOS iOS and iPadOS watchOS macOS iOS

Jun 23, 2023
KEV Jun 23, 2023
High 8.6

CVE-2023-32409 Exploited EPSS 17%

The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4,…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 23, 2023
KEV May 22, 2023
High 8.8

CVE-2023-32435 Exploited EPSS 23%

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safa…

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Jun 23, 2023
KEV Jun 23, 2023
High 8.8

CVE-2023-32373 Exploited EPSS 12%

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, ma…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 23, 2023
KEV May 22, 2023
High 8.8

CVE-2023-32439 Exploited EPSS 24%

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.…

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Jun 23, 2023
KEV Jun 23, 2023
High 8.4

CVE-2023-2533 Exploited EPSS 29%

PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an a…

PaperCut PaperCut NG/MF

Jun 20, 2023
KEV Jul 28, 2025
Critical 9.8

CVE-2023-27992 Exploited EPSS 82%

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0,…

Zyxel NAS326 firmware NAS542 firmware NAS540 firmware Network devices

Jun 19, 2023
KEV Jun 23, 2023
High 8.4

CVE-2023-29360 Exploited Public exploit EPSS 22%

Microsoft Streaming Service Elevation of Privilege Vulnerability

Microsoft Streaming Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 13, 2023
KEV Feb 29, 2024
Critical 9.8

CVE-2023-29357 Exploited · Ransomware Public exploit EPSS 100%

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Microsoft Microsoft SharePoint Server 2019

Jun 13, 2023
KEV Jan 10, 2024
Low 3.9

CVE-2023-20867 Exploited EPSS 14%

VMware Tools Authentication Bypass Vulnerability

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

VMware VMware tools open-vm-tools open-vm-tools Debian Ubuntu Alpine

Jun 13, 2023
KEV Jun 23, 2023
Critical 9.2

CVE-2023-27997 Exploited · Ransomware Public exploit EPSS 87%

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, vers…

Fortinet FortiOS FortiProxy FortiOS-6K7K Network devices

Jun 13, 2023
KEV Jun 13, 2023
Critical 9.8

CVE-2023-20887 Exploited Public exploit EPSS 98%

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMwar…

Jun 7, 2023
KEV Jun 22, 2023
High 8.8

CVE-2023-33538 Exploited Public exploit EPSS 42%

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabil…

Jun 7, 2023
KEV Jun 16, 2025
High 8.8

CVE-2023-3079 Exploited Public exploit EPSS 38%

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap cor…

Google Chrome chromium qt5-qtwebengine Browsers Debian Alpine

Jun 5, 2023
KEV Jun 7, 2023
Critical 9.8

CVE-2023-34362 Exploited · Ransomware Public exploit EPSS 100%

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023…

Jun 2, 2023
KEV Jun 2, 2023
High 8.6

CVE-2023-32315 Exploited Public exploit EPSS 100%

Openfire administration console authentication bypass

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to us…

igniterealtime Openfire org.igniterealtime.openfire:xmppserver openfire Alpine Maven

May 26, 2023
KEV Aug 24, 2023
Critical 9.4

CVE-2023-2868 Exploited Public exploit EPSS 87%

Remote Code injection in Barracuda Email Security Gateway

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar f…

Barracuda Barracuda Email Security Gateway

May 24, 2023
KEV May 26, 2023
Critical 9.8

CVE-2023-33246 Exploited Public exploit EPSS 97%

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attack…

Apache Software Foundation Apache RocketMQ org.apache.rocketmq:rocketmq-broker org.apache.rocketmq:rocketmq-namesrv Maven

May 24, 2023
KEV Sep 6, 2023
Critical 9.8

CVE-2023-33009 Exploited EPSS 28%

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Pa…

Zyxel USG FLEX series firmware ATP series firmware VPN series Firmware Network devices

May 24, 2023
KEV Jun 5, 2023
Critical 9.8

CVE-2023-33010 Exploited EPSS 29%

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 P…

Zyxel USG FLEX series firmware ATP series firmware VPN series Firmware Network devices

May 24, 2023
KEV Jun 5, 2023
High 7.8

CVE-2023-29336 Exploited Public exploit EPSS 41%

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2016 Windows Server 2016 (Server Core installation) Windows 10 Version 1607 Windows

May 9, 2023
KEV May 9, 2023
High 7.2

CVE-2023-24955 Exploited · Ransomware Public exploit EPSS 85%

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition

May 9, 2023
KEV Mar 26, 2024
Medium 4.4

CVE-2023-21492 Exploited

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypas…

Samsung Mobile Samsung Mobile Devices

May 4, 2023
KEV May 19, 2023
Critical 9.8

CVE-2023-28771 Exploited Public exploit EPSS 99%

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware ver…

Zyxel USG FLEX series firmware ATP series firmware VPN series Firmware Network devices

Apr 25, 2023
KEV May 31, 2023
High 7.5

CVE-2023-29552 Exploited EPSS 64%

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services…

openslp-dfsg Ubuntu

Apr 25, 2023
KEV Nov 8, 2023
High 8.9

CVE-2023-27524 Exploited Public exploit EPSS 98%

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resour…

Apache Software Foundation Apache Superset apache-superset PyPI

Apr 24, 2023
KEV Jan 8, 2024
High 8.2

CVE-2023-27351 Exploited · Ransomware EPSS 78%

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

PaperCut NG

Apr 20, 2023
KEV Apr 20, 2026
Critical 9.8

CVE-2023-27350 Exploited · Ransomware Public exploit EPSS 100%

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

PaperCut NG

Apr 20, 2023
KEV Apr 21, 2023
Critical 9.6

CVE-2023-2136 Exploited

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the ren…

Google Chrome chromium Browsers Debian

Apr 19, 2023
KEV Apr 21, 2023
High 7.2

CVE-2023-22894 Exploited Public exploit

Strapi leaking sensitive user information by filtering on private fields

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the …

@strapi/strapi npm

Apr 19, 2023
KEV Oct 8, 2026
High 8.8

CVE-2023-2033 Exploited Public exploit EPSS 41%

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap cor…

Google Chrome chromium qt5-qtwebengine Browsers Debian Alpine

Apr 14, 2023
KEV Apr 17, 2023
High 7.8

CVE-2023-28252 Exploited · Ransomware Public exploit EPSS 49%

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Apr 11, 2023
KEV Apr 11, 2023
High 7.0

CVE-2023-28229 Exploited Public exploit

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Apr 11, 2023
KEV Oct 4, 2023
Critical 9.8

CVE-2023-29492 Exploited

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the serv…

Apr 11, 2023
KEV Apr 13, 2023
High 8.8

CVE-2023-28205 Exploited Public exploit EPSS 27%

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 …

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Apr 10, 2023
KEV Apr 10, 2023
High 8.6

CVE-2023-28206 Exploited Public exploit EPSS 23%

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5…

Apple macOS iOS and iPadOS macOS iOS

Apr 10, 2023
KEV Apr 10, 2023
Low 3.3

CVE-2023-26083 Exploited Public exploit

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifros…

Apr 6, 2023
KEV Apr 7, 2023
Medium 6.5

CVE-2023-20118 Exploited EPSS 54%

A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV32…

Cisco Cisco Small Business RV Series Router Firmware Network devices

Apr 5, 2023
KEV Mar 3, 2025
Critical 9.8

CVE-2023-1671 Exploited Public exploit EPSS 100%

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.1…

Sophos Sophos Web Appliance Network devices

Apr 4, 2023
KEV Nov 16, 2023

Latest vulnerabilities

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macO…

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 1…

The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4,…

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safa…

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, ma…

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.…

PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0,…

Microsoft Streaming Service Elevation of Privilege Vulnerability

Microsoft SharePoint Server Elevation of Privilege Vulnerability

VMware Tools Authentication Bypass Vulnerability

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, vers…

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMwar…

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabil…

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap cor…

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023…

Openfire administration console authentication bypass

Remote Code injection in Barracuda Email Security Gateway

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Pa…

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 P…

Win32k Elevation of Privilege Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypas…

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware ver…

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services…

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the ren…

Strapi leaking sensitive user information by filtering on private fields

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap cor…

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the serv…

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 …

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5…

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifros…

A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV32…

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.1…