Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 409,067
Last 24h: 679
Critical, 7 days: 350
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,796 results · Clear filters · Feed

Medium 6.4

CVE-2021-25394 Exploited

A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrar…

Samsung Mobile Samsung Mobile Devices

Jun 11, 2021
KEV Jun 29, 2023
Medium 6.4

CVE-2021-25395 Exploited

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check…

Samsung Mobile Samsung Mobile Devices

Jun 11, 2021
KEV Jun 29, 2023
High 8.8

CVE-2021-26828 Exploited Public exploit EPSS 39%

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and ex…

Jun 11, 2021
KEV Dec 3, 2025
Medium 5.4

CVE-2021-26829 Exploited EPSS 48%

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

Jun 11, 2021
KEV Nov 28, 2025
High 7.8

CVE-2020-11261 Exploited

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size…

Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

Jun 9, 2021
KEV Dec 1, 2021
High 7.5

CVE-2021-33742 Exploited EPSS 59%

Windows MSHTML Platform Remote Code Execution Vulnerability

Windows MSHTML Platform Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2016 Windows

Jun 8, 2021
KEV Nov 3, 2021
High 8.4

CVE-2021-33739 Exploited Public exploit

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 20H2 Windows 10 Version 1909 Windows Server version 20H2 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 5.5

CVE-2021-31955 Exploited Public exploit EPSS 81%

Windows Kernel Information Disclosure Vulnerability

Windows Kernel Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-31956 Exploited Public exploit EPSS 22%

Windows NTFS Elevation of Privilege Vulnerability

Windows NTFS Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 5.2

CVE-2021-31199 Exploited

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 5.2

CVE-2021-31201 Exploited

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
High 7.8

CVE-2021-1675 Exploited · Ransomware Public exploit EPSS 85%

Windows Print Spooler Remote Code Execution Vulnerability

Windows Print Spooler Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 6.5

CVE-2021-30533 Exploited EPSS 17%

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jun 7, 2021
KEV Jun 27, 2022
Critical 9.8

CVE-2021-27852 Exploited EPSS 30%

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote …

Checkbox Survey

May 27, 2021
KEV Apr 11, 2022
High 7.2

CVE-2021-22900 Exploited EPSS 14%

A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an aut…

May 27, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-22899 Exploited EPSS 23%

A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker…

May 27, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-22894 Exploited EPSS 41%

A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker t…

May 27, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-21985 Exploited · Ransomware Public exploit EPSS 100%

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

Virtualization

May 26, 2021
KEV Nov 3, 2021
Medium 5.5

CVE-2021-27562 Exploited

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the prin…

May 25, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-29256 Exploited

. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information …

May 24, 2021
KEV Jul 7, 2023
Critical 10.0

CVE-2021-28799 Exploited · Ransomware EPSS 78%

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.…

QNAP Systems HBS 3 HBS 2 HBS 1.3

May 13, 2021
KEV Mar 31, 2022
Medium 6.6

CVE-2021-31207 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19

May 11, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-31166 Exploited Public exploit EPSS 100%

HTTP Protocol Stack Remote Code Execution Vulnerability

HTTP Protocol Stack Remote Code Execution Vulnerability

Microsoft Windows 10 Version 20H2 Windows Server version 20H2 Windows 10 Version 2004 Windows

May 11, 2021
KEV Apr 6, 2022
High 8.8

CVE-2021-28664 Exploited Public exploit

The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unpriv…

May 10, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-28663 Exploited Public exploit EPSS 12%

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …

May 10, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-31755 Exploited EPSS 87%

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerabil…

May 7, 2021
KEV Nov 3, 2021
Medium 6.2

CVE-2021-1906 Exploited

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Au…

Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

May 7, 2021
KEV Nov 3, 2021
High 8.4

CVE-2021-1905 Exploited

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon …

Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

May 7, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-32030 Exploited EPSS 99%

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630…

May 6, 2021
KEV Jun 2, 2025
Critical 9.8

CVE-2021-1498 Exploited Public exploit EPSS 100%

Cisco HyperFlex HX Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

Cisco Cisco HyperFlex HX Data Platform Network devices

May 6, 2021
KEV Nov 3, 2021
Critical 9.8

CVE-2021-1497 Exploited Public exploit EPSS 100%

Cisco HyperFlex HX Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

Cisco Cisco HyperFlex HX Data Platform Network devices

May 6, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-21551 Exploited Public exploit EPSS 80%

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privil…

Dell dbutil

May 4, 2021
KEV Mar 31, 2022
Critical 9.8

CVE-2021-20090 Exploited EPSS 100%

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3…

Apr 29, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-21224 Exploited EPSS 84%

Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside …

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Apr 26, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-21206 Exploited

Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap c…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Apr 26, 2021
KEV Nov 3, 2021
High 8.8

CVE-2021-21220 Exploited Public exploit EPSS 70%

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Apr 26, 2021
KEV Nov 3, 2021
Critical 10.0

CVE-2021-22205 Exploited · Ransomware Public exploit EPSS 100%

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

GitLab GitLab gitlab Web / CMS Ubuntu

Apr 23, 2021
KEV Nov 3, 2021
Medium 6.8

CVE-2021-22204 Exploited Public exploit EPSS 100%

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…

ExifTool ExifTool libimage-exiftool-perl libimage-exiftool-perl Debian Ubuntu Alpine

Apr 23, 2021
KEV Nov 17, 2021
Critical 10.0

CVE-2021-22893 Exploited · Ransomware Public exploit EPSS 48%

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

Apr 23, 2021
KEV Nov 3, 2021
Medium 4.9

CVE-2021-20023 Exploited · Ransomware EPSS 52%

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an…

SonicWall Email Security Network devices

Apr 20, 2021
KEV Nov 3, 2021

Latest vulnerabilities

A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrar…

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check…

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and ex…

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size…

Windows MSHTML Platform Remote Code Execution Vulnerability

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Windows Kernel Information Disclosure Vulnerability

Windows NTFS Elevation of Privilege Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Windows Print Spooler Remote Code Execution Vulnerability

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp…

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote …

A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an aut…

A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker…

A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker t…

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the prin…

. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information …

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

Microsoft Exchange Server Security Feature Bypass Vulnerability

HTTP Protocol Stack Remote Code Execution Vulnerability

The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unpriv…

The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerabil…

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Au…

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon …

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630…

Cisco HyperFlex HX Command Injection Vulnerabilities

Cisco HyperFlex HX Command Injection Vulnerabilities

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privil…

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3…

Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside …

Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap c…

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validat…

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an…