Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,020
- Last 24h
- 633
- Critical, 7 days
- 348
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
Medium 6.5
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain poten…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the rend…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised t…
KEV Nov 3, 2021 -
High 8.8
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap …
KEV Nov 3, 2021 -
High 8.8
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corru…
KEV Nov 3, 2021 -
Critical 9.8
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…
KEV Nov 3, 2021 -
Low 3.3CVE-2021-25489 Exploited
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1…
KEV Jun 29, 2023 -
High 7.3CVE-2021-25487 Exploited
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allow…
KEV Jun 29, 2023 -
Critical 9.8
Snapshot authentication bypass in grafana
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If…
KEV Aug 25, 2022 -
High 7.5
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…
KEV Nov 3, 2021 -
Medium 6.5CVE-2021-20035 Exploited
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker t…
KEV Apr 16, 2025 -
High 7.5
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user nam…
KEV May 16, 2024 -
Critical 9.8
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…
KEV Mar 25, 2022 -
Medium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mal…
KEV Jan 10, 2022 -
Critical 9.8
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…
KEV Nov 3, 2021 -
Critical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation…
KEV Jan 10, 2022 -
High 7.8
Delta Electronics DOPSoft 2 Out-of-Bounds Write
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute cod…
KEV Aug 25, 2022 -
Critical 9.0
mod_proxy SSRF
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
KEV Dec 1, 2021 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
High 8.8
Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An a…
KEV Nov 3, 2021 -
High 7.0CVE-2021-38649 Exploited
Open Management Infrastructure Elevation of Privilege Vulnerability
Open Management Infrastructure Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 7.8
Open Management Infrastructure Elevation of Privilege Vulnerability
Open Management Infrastructure Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.8
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8CVE-2021-38646 Exploited · Ransomware
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
KEV Mar 28, 2022 -
High 7.8CVE-2021-38645 Exploited
Open Management Infrastructure Elevation of Privilege Vulnerability
Open Management Infrastructure Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.9
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…
KEV Jun 9, 2022 -
Critical 9.8
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous…
KEV Jan 18, 2022 -
High 7.8CVE-2021-30663 Exploited
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, …
KEV Nov 3, 2021 -
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …
KEV Nov 3, 2021 -
High 8.8CVE-2021-30661 Exploited
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, i…
KEV Nov 3, 2021 -
High 7.8CVE-2021-30713 Exploited
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious appl…
KEV Nov 3, 2021 -
High 8.8CVE-2021-30666 Exploited
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing mali…
KEV Nov 3, 2021 -
High 8.8CVE-2021-30665 Exploited
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.…
KEV Nov 3, 2021 -
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing mal…
KEV Nov 3, 2021 -
High 8.8
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing m…
KEV Nov 3, 2021 -
Critical 9.8
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…
KEV Nov 3, 2021 -
Critical 9.6
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …
KEV Nov 3, 2021 -
Critical 9.8
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs …
KEV Dec 1, 2021