Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,013
- Last 24h
- 804
- Critical, 7 days
- 353
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
High 8.6
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
KEV Mar 3, 2025 -
High 8.8
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
KEV Mar 3, 2025 -
High 7.8
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional…
KEV Apr 13, 2023 -
Critical 9.8CVE-2022-42948 Exploited
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafte…
KEV Mar 30, 2023 -
High 8.6
Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…
KEV Mar 15, 2023 -
Critical 9.8
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss…
KEV Aug 21, 2023 -
High 8.8
MinIO is vulnerable to privilege escalation on Linux/MacOS
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…
KEV Sep 19, 2023 -
High 7.5
Minio Information Disclosure in Cluster Deployment
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, res…
KEV Apr 21, 2023 -
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
Critical 9.8
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a c…
KEV Sep 30, 2024 -
Critical 9.8
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the…
KEV Nov 25, 2024 -
High 8.8
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability …
KEV May 1, 2023 -
Medium 4.4
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Mar 14, 2023 -
Critical 9.8
Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
KEV Mar 14, 2023 -
High 7.5
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…
KEV Aug 22, 2023 -
Medium 6.5
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet For…
KEV Mar 14, 2023 -
High 8.8CVE-2019-8720 Exploited
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lea…
KEV May 23, 2022 -
High 8.8CVE-2023-23529 Exploited
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.…
KEV Feb 14, 2023 -
Critical 9.8
IBM Aspera Faspex code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…
KEV Feb 21, 2023 -
Medium 5.3
[20230201] - Core - Improper access check in webservice endpoints
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
KEV Jan 8, 2024 -
High 7.8
Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
KEV Feb 14, 2023 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Feb 14, 2023 -
High 7.3
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability
KEV Feb 14, 2023 -
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Apr 13, 2026 -
Critical 9.8
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrate…
KEV May 12, 2023 -
Critical 9.8
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Age…
KEV Feb 10, 2023 -
High 7.2
Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
KEV Feb 10, 2023 -
High 7.9
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …
KEV Mar 30, 2023 -
High 7.8
Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…
KEV Oct 10, 2023 -
Critical 9.8
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due…
KEV Jan 23, 2023 -
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV May 1, 2023 -
High 8.8
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because …
KEV Feb 2, 2023 -
High 8.8
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
KEV Jan 10, 2023 -
Critical 9.8
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execu…
KEV Jan 17, 2023 -
Critical 9.3
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…
KEV Dec 13, 2022 -
High 8.8
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…
KEV Mar 7, 2022 -
Critical 9.6CVE-2022-26486 Exploited
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…
KEV Mar 7, 2022 -
High 8.8CVE-2022-42856 Exploited
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS…
KEV Dec 14, 2022 -
Critical 9.8
Unauthenticated remote arbitrary code execution
Unauthenticated remote arbitrary code execution
KEV Dec 13, 2022 -
Medium 5.4
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Dec 13, 2022