Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 409,020
Last 24h: 796
Critical, 7 days: 348
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,796 results · Clear filters · Feed

Critical 9.1

CVE-2022-23131 Exploited Public exploit EPSS 96%

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to esca…

Zabbix Frontend

Jan 13, 2022
KEV Feb 22, 2022
High 7.0

CVE-2022-21919 Exploited

Windows User Profile Service Elevation of Privilege Vulnerability

Windows User Profile Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
KEV Apr 25, 2022
High 7.0

CVE-2022-21882 Exploited · Ransomware Public exploit EPSS 59%

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
KEV Feb 4, 2022
Medium 4.3

CVE-2021-35247 Exploited

Improper Input Validation Vulnerability in Serv-U

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as t…

SolarWinds Serv-U

Jan 7, 2022
KEV Jan 21, 2022
Medium 5.0

CVE-2022-22265 Exploited

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary …

Samsung Mobile Samsung Mobile Devices

Jan 7, 2022
KEV Sep 18, 2023
Low 3.3

CVE-2021-44168 Exploited Public exploit

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0…

Fortinet Fortinet FortiOS Network devices

Jan 4, 2022
KEV Dec 10, 2021
High 8.1

CVE-2021-44207 Exploited EPSS 17%

Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.

Dec 21, 2021
KEV Dec 23, 2024
High 7.5

CVE-2021-22054 Exploited Public exploit EPSS 100%

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and…

Dec 17, 2021
KEV Mar 9, 2026
High 7.8

CVE-2021-1048 Exploited

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lea…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Dec 15, 2021
KEV May 23, 2022
Medium 6.4

CVE-2021-0920 Exploited

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Dec 15, 2021
KEV May 23, 2022
High 7.1

CVE-2021-43890 Exploited · Ransomware EPSS 11%

Windows AppX Installer Spoofing Vulnerability

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Em…

Microsoft App Installer

Dec 15, 2021
KEV Dec 15, 2021
High 7.8

CVE-2021-43226 Exploited · Ransomware Public exploit

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 15, 2021
KEV Oct 6, 2025
Critical 9.0

CVE-2021-45046 Exploited · Ransomware Public exploit EPSS 100%

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Dec 14, 2021
KEV May 1, 2023
Medium 6.8

CVE-2021-39935 Exploited EPSS 36%

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions star…

GitLab GitLab gitlab Web / CMS Ubuntu

Dec 13, 2021
KEV Feb 3, 2026
Critical 9.8

CVE-2021-44515 Exploited EPSS 100%

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the serve…

Dec 12, 2021
KEV Dec 10, 2021
Critical 10.0

CVE-2021-44228 Exploited · Ransomware Public exploit EPSS 100%

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Dec 10, 2021
KEV Dec 10, 2021
Critical 9.8

CVE-2021-27860 Exploited EPSS 40%

Arbitrary file upload vulnerability in FatPipe software

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identi…

FatPipe MPVPN IPVPN WARP

Dec 8, 2021
KEV Jan 10, 2022
Critical 9.8

CVE-2021-20038 Exploited · Ransomware Public exploit EPSS 100%

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…

SonicWall SonicWall SMA100 Network devices

Dec 8, 2021
KEV Jan 28, 2022
Critical 9.8

CVE-2021-44529 Exploited · Ransomware Public exploit EPSS 99%

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execu…

Dec 8, 2021
KEV Mar 25, 2024
High 7.5

CVE-2021-43798 Exploited Public exploit EPSS 89%

Grafana path traversal

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…

Grafana Grafana github.com/grafana/grafana grafana Web / CMS Alpine Go

Dec 7, 2021
KEV Oct 9, 2025
High 8.1

CVE-2021-23758 Exploited Public exploit EPSS 83%

Deserialization of Untrusted Data

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

AjaxNetProfessional NuGet

Dec 3, 2021
KEV Aug 26, 2026
Critical 9.8

CVE-2021-44077 Exploited Public exploit EPSS 94%

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014…

Nov 29, 2021
KEV Dec 1, 2021
High 8.8

CVE-2021-38003 Exploited Public exploit EPSS 39%

Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially expl…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Nov 23, 2021
KEV Nov 3, 2021
Medium 6.1

CVE-2021-38000 Exploited

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remot…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 23, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-44026 Exploited Public exploit EPSS 70%

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

roundcube roundcube Debian Ubuntu

Nov 19, 2021
KEV Jun 22, 2023
Critical 10.0

CVE-2021-41277 Exploited Public exploit EPSS 97%

GeoJSON URL validation can expose server files and environment variables to unauthorized users

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…

metabase metabase

Nov 17, 2021
KEV Nov 12, 2024
High 8.8

CVE-2021-42321 Exploited · Ransomware Public exploit EPSS 92%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2016 Cumulative Update 22 Microsoft Exchange Server 2016 Cumulative Update 21

Nov 10, 2021
KEV Nov 17, 2021
High 7.8

CVE-2021-42292 Exploited Public exploit EPSS 43%

Microsoft Excel Security Feature Bypass Vulnerability

Microsoft Excel Security Feature Bypass Vulnerability

Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC for Mac 2021

Nov 10, 2021
KEV Nov 17, 2021
High 7.5

CVE-2021-42287 Exploited · Ransomware Public exploit EPSS 77%

Active Directory Domain Services Elevation of Privilege Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Nov 10, 2021
KEV Apr 11, 2022
High 7.5

CVE-2021-42278 Exploited · Ransomware Public exploit EPSS 73%

Active Directory Domain Services Elevation of Privilege Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Nov 10, 2021
KEV Apr 11, 2022
Medium 5.5

CVE-2021-41379 Exploited · Ransomware EPSS 19%

Windows Installer Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 10, 2021
KEV Mar 3, 2022
Critical 9.8

CVE-2021-42237 Exploited · Ransomware Public exploit EPSS 98%

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…

Nov 5, 2021
KEV Mar 25, 2022
Critical 9.8

CVE-2021-42258 Exploited · Ransomware Public exploit EPSS 75%

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…

Oct 22, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-30807 Exploited Public exploit EPSS 29%

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS…

Apple macOS macOS

Oct 19, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-27561 Exploited EPSS 84%

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,…

Oct 15, 2021
KEV Nov 3, 2021
High 7.5

CVE-2021-20124 Exploited EPSS 96%

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …

Oct 13, 2021
KEV Sep 3, 2024
High 7.5

CVE-2021-20123 Exploited EPSS 90%

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …

Oct 13, 2021
KEV Sep 3, 2024
High 7.8

CVE-2021-41357 Exploited

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2022 Windows 11 version 21H2 Windows 10 Version 20H2 Windows

Oct 13, 2021
KEV Apr 25, 2022
High 7.8

CVE-2021-40450 Exploited

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 13, 2021
KEV Apr 25, 2022
High 7.8

CVE-2021-40449 Exploited · Ransomware Public exploit EPSS 82%

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 13, 2021
KEV Nov 17, 2021

Latest vulnerabilities

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

Windows User Profile Service Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Improper Input Validation Vulnerability in Serv-U

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary …

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0…

Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and…

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lea…

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…

Windows AppX Installer Spoofing Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions star…

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the serve…

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Arbitrary file upload vulnerability in FatPipe software

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execu…

Grafana path traversal

Deserialization of Untrusted Data

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014…

Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially expl…

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remot…

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

GeoJSON URL validation can expose server files and environment variables to unauthorized users

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Excel Security Feature Bypass Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS…

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,…

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the …

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability