Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 409,013
Last 24h: 797
Critical, 7 days: 352
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,796 results · Clear filters · Feed

Critical 9.8

CVE-2022-46169 Exploited Public exploit EPSS 100%

Unauthenticated Command Injection

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

Cacti cacti cacti cacti Debian Ubuntu

Dec 5, 2022
KEV Feb 16, 2023
High 8.8

CVE-2022-4262 Exploited Public exploit EPSS 24%

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Dec 2, 2022
KEV Dec 5, 2022
High 8.8

CVE-2022-40799 Exploited EPSS 34%

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS …

Nov 29, 2022
KEV Aug 5, 2025
Critical 9.6

CVE-2022-4135 Exploited EPSS 32%

Heap buffer overflow in GPU

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Google Chrome chromium chromium-browser Browsers Debian Ubuntu npm

Nov 25, 2022
KEV Nov 28, 2022
Medium 6.8

CVE-2022-40765 Exploited · Ransomware EPSS 11%

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authe…

Nov 22, 2022
KEV Feb 21, 2023
Medium 6.8

CVE-2022-41223 Exploited · Ransomware EPSS 11%

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to…

Nov 22, 2022
KEV Feb 21, 2023
High 7.8

CVE-2022-23748 Exploited

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from wh…

Windows

Nov 17, 2022
KEV Feb 6, 2025
High 7.8

CVE-2022-41073 Exploited · Ransomware

Windows Print Spooler Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 9, 2022
KEV Nov 8, 2022
High 7.8

CVE-2022-41125 Exploited

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 9, 2022
KEV Nov 8, 2022
High 8.8

CVE-2022-41128 Exploited EPSS 25%

Windows Scripting Languages Remote Code Execution Vulnerability

Windows Scripting Languages Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2022 Windows

Nov 9, 2022
KEV Nov 8, 2022
Medium 5.4

CVE-2022-41049 Exploited

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 9, 2022
KEV Nov 14, 2022
Medium 5.4

CVE-2022-41091 Exploited · Ransomware

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 9, 2022
KEV Nov 8, 2022
High 8.8

CVE-2022-41080 Exploited · Ransomware Public exploit EPSS 77%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Nov 9, 2022
KEV Jan 10, 2023
Critical 9.8

CVE-2022-31199 Exploited · Ransomware Public exploit EPSS 36%

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…

Nov 8, 2022
KEV Jul 11, 2023
High 8.8

CVE-2022-3723 Exploited

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corr…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
KEV Oct 28, 2022
High 7.8

CVE-2022-42827 Exploited

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS …

Apple iOS and iPadOS iOS

Nov 1, 2022
KEV Oct 25, 2022
High 8.8

CVE-2022-38181 Exploited Public exploit EPSS 18%

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…

Oct 25, 2022
KEV Mar 30, 2023
Critical 9.8

CVE-2016-20017 Exploited Public exploit EPSS 66%

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…

Oct 19, 2022
KEV Jan 8, 2024
Critical 9.8

CVE-2022-40684 Exploited · Ransomware Public exploit EPSS 100%

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Network devices

Oct 18, 2022
KEV Oct 11, 2022
Critical 9.8

CVE-2022-21587 Exploited · Ransomware Public exploit EPSS 98%

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

Oracle Web Applications Desktop Integrator

Oct 18, 2022
KEV Feb 2, 2023
High 7.8

CVE-2022-38028 Exploited EPSS 15%

Windows Print Spooler Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 11, 2022
KEV Apr 23, 2024
High 7.8

CVE-2022-41033 Exploited

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 11, 2022
KEV Oct 11, 2022
High 8.8

CVE-2022-41040 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Oct 3, 2022
KEV Sep 30, 2022
High 8.0

CVE-2022-41082 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Oct 3, 2022
KEV Sep 30, 2022
High 7.8

CVE-2022-20775 Exploited EPSS 12%

Cisco SD-WAN Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerab…

Cisco Cisco Catalyst SD-WAN Manager Cisco SD-WAN vEdge Router Cisco SD-WAN vEdge Cloud Network devices

Sep 30, 2022
KEV Feb 25, 2026
Critical 9.6

CVE-2022-3075 Exploited

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had comprom…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Sep 26, 2022
KEV Sep 8, 2022
High 8.8

CVE-2022-3038 Exploited EPSS 25%

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially expl…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Sep 26, 2022
KEV Mar 30, 2023
Medium 6.5

CVE-2022-2856 Exploited

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a rem…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Sep 26, 2022
KEV Aug 18, 2022
Critical 9.8

CVE-2022-41352 Exploited · Ransomware Public exploit EPSS 95%

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

Sep 26, 2022
KEV Oct 20, 2022
Critical 9.8

CVE-2022-3236 Exploited EPSS 99%

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firew…

Sophos Sophos Firewall Network devices

Sep 23, 2022
KEV Sep 23, 2022
Medium 6.1

CVE-2022-39197 Exploited Public exploit EPSS 44%

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…

Sep 22, 2022
KEV Mar 30, 2023
High 7.8

CVE-2022-32917 Exploited

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15…

Apple macOS iOS macOS iOS

Sep 20, 2022
KEV Sep 14, 2022
High 7.2

CVE-2022-40139 Exploited

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One …

Trend Micro Trend Micro Apex One

Sep 19, 2022
KEV Sep 15, 2022
Critical 9.8

CVE-2022-35914 Exploited Public exploit EPSS 100%

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Sep 19, 2022
KEV Mar 7, 2023
High 7.8

CVE-2022-37969 Exploited · Ransomware Public exploit EPSS 28%

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Sep 13, 2022
KEV Sep 14, 2022
Critical 10.0

CVE-2022-27593 Exploited · Ransomware EPSS 88%

DeadBolt Ransomware

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QT…

QNAP Systems Photo Station

Sep 8, 2022
KEV Sep 8, 2022
Critical 9.8

CVE-2022-37055 Exploited EPSS 56%

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, …

Aug 28, 2022
KEV Dec 8, 2025
High 7.5

CVE-2022-36537 Exploited · Ransomware Public exploit EPSS 95%

ZK Framework vulnerable to malicious POST

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

org.zkoss.zk:zk Maven

Aug 26, 2022
KEV Feb 27, 2023
High 8.8

CVE-2022-36804 Exploited Public exploit EPSS 99%

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…

Atlassian Bitbucket Server Bitbucket Data Center

Aug 25, 2022
KEV Sep 30, 2022
High 8.8

CVE-2022-32893 Exploited EPSS 10%

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Aug 24, 2022
KEV Aug 18, 2022

Latest vulnerabilities

Unauthenticated Command Injection

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS …

Heap buffer overflow in GPU

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authe…

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to…

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from wh…

Windows Print Spooler Elevation of Privilege Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Windows Scripting Languages Remote Code Execution Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corr…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS …

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

Windows Print Spooler Elevation of Privilege Vulnerability

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Cisco SD-WAN Software Privilege Escalation Vulnerability

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had comprom…

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially expl…

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a rem…

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firew…

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15…

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One …

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Windows Common Log File System Driver Elevation of Privilege Vulnerability

DeadBolt Ransomware

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, …

ZK Framework vulnerable to malicious POST

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …