Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,020
- Last 24h
- 796
- Critical, 7 days
- 349
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
Critical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to up…
KEV Mar 31, 2022 -
Medium 6.5
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…
KEV Jul 17, 2024 -
Critical 9.8
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set…
KEV Sep 8, 2022 -
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
Critical 9.8
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…
KEV Mar 31, 2022 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS…
KEV Feb 11, 2022 -
Critical 9.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3…
KEV Jan 28, 2022 -
High 8.8CVE-2022-26500 Exploited · Ransomware
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated…
KEV Dec 13, 2022 -
Critical 9.8CVE-2022-26501 Exploited · Ransomware
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
KEV Dec 13, 2022 -
High 7.8CVE-2021-39793 Exploited
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the…
KEV Apr 11, 2022 -
Critical 9.8
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allow…
KEV Mar 25, 2022 -
High 7.8
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in co…
KEV Apr 25, 2022 -
Critical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulne…
KEV Mar 25, 2022 -
High 7.8
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects…
KEV Mar 30, 2023 -
High 7.8
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. T…
KEV Jun 2, 2026 -
Critical 10.0
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could al…
KEV May 16, 2022 -
High 8.8
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a…
KEV Apr 11, 2022 -
Critical 10.0
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specifi…
KEV Mar 28, 2022 -
Critical 9.8
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826…
KEV Apr 4, 2022 -
Critical 9.8
Adobe Commerce checkout improper input validation leads to remote code execution
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code e…
KEV Feb 15, 2022 -
High 7.8
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privil…
KEV May 12, 2023 -
High 8.8CVE-2021-4102 Exploited
Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corr…
KEV Dec 15, 2021 -
High 8.4
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functi…
KEV Aug 21, 2024 -
Critical 9.8
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…
KEV Aug 25, 2022 -
Critical 10.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0CVE-2022-20700 Exploited
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0CVE-2022-20701 Exploited
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0CVE-2022-20703 Exploited
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 10.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
KEV Mar 3, 2022 -
Critical 9.8
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…
KEV Aug 18, 2022 -
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
KEV Apr 19, 2022 -
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
KEV Mar 25, 2022 -
High 7.8
Windows Runtime Remote Code Execution Vulnerability
Windows Runtime Remote Code Execution Vulnerability
KEV Aug 18, 2022 -
Medium 6.1
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), …
KEV Feb 25, 2022 -
Critical 9.1
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
KEV Dec 18, 2024 -
High 7.8
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid too…
KEV Jun 27, 2022 -
Medium 6.6
Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…
KEV Apr 11, 2022 -
Critical 9.8
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…
KEV Nov 28, 2022 -
Critical 9.8
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused t…
KEV Dec 18, 2024 -
Low 3.7
Possible view of the setup pages by unauthenticated users if config file already exists
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
KEV Feb 22, 2022