Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,099
- Last 24h
- 637
- Critical, 7 days
- 349
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
Medium 6.1
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…
KEV May 24, 2022 -
High 8.0
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…
KEV May 24, 2022 -
Critical 9.8
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has alr…
KEV May 24, 2022 -
High 7.2
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perfor…
KEV Nov 3, 2021 -
Medium 6.1
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against …
KEV Nov 3, 2021 -
High 7.2
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
KEV Nov 3, 2021 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
KEV Nov 3, 2021 -
High 7.5
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: In…
KEV Jan 18, 2022 -
Critical 10.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported v…
KEV Nov 3, 2021 -
Critical 9.8
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…
KEV Nov 3, 2021 -
Medium 5.5
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…
KEV Sep 8, 2022 -
High 7.8CVE-2020-9907 Exploited
A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.…
KEV Jun 27, 2022 -
Critical 9.8
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially ex…
KEV Mar 15, 2022 -
Critical 9.8
NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
KEV Nov 3, 2021 -
High 7.2
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to uplo…
KEV Nov 3, 2021 -
Critical 9.8
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511…
KEV Mar 25, 2022 -
High 8.6CVE-2020-3569 Exploited
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it co…
KEV Nov 3, 2021 -
Medium 4.2CVE-2020-0878 Exploited · Ransomware
Microsoft Browser Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker…
KEV Nov 3, 2021 -
Critical 10.0
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitr…
KEV Nov 3, 2021 -
High 7.5
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticat…
KEV Aug 5, 2025 -
High 8.8
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.…
KEV Aug 5, 2025 -
High 7.8CVE-2020-24557 Exploited
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an att…
KEV Nov 3, 2021 -
High 8.8
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDD…
KEV Sep 2, 2025 -
High 8.6CVE-2020-3566 Exploited
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue manageme…
KEV Nov 3, 2021 -
High 7.8
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.…
KEV Apr 13, 2026 -
Medium 5.5
Netlogon Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could ru…
KEV Nov 3, 2021 -
High 7.8
Windows Spoofing Vulnerability
A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass secu…
KEV Nov 3, 2021 -
High 7.8
Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current …
KEV Nov 3, 2021 -
High 7.8
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to ha…
KEV Oct 24, 2022 -
Medium 6.5
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …
KEV Nov 3, 2021 -
Critical 9.8
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
KEV Dec 10, 2021 -
Critical 9.8
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…
KEV Nov 3, 2021 -
High 7.2
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perfor…
KEV Mar 7, 2022 -
High 7.5
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a u…
KEV Nov 3, 2021 -
High 7.5
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files…
KEV Nov 3, 2021 -
High 8.8
Remote code execution (RCE) in Apache Airflow
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…
KEV Jan 18, 2022 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Sep 18, 2024 -
Critical 10.0
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle re…
KEV Nov 3, 2021 -
High 7.8
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulne…
KEV Nov 3, 2021 -
Critical 9.0CVE-2020-1040 Exploited
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
KEV Nov 3, 2021