Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,099
- Last 24h
- 621
- Critical, 7 days
- 349
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
Critical 10.0
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …
KEV Nov 3, 2021 -
Critical 9.8
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary …
KEV Nov 3, 2021 -
Medium 4.3
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
Medium 6.5
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.…
KEV Nov 3, 2021 -
Medium 6.5
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
High 8.8
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability on…
KEV Mar 25, 2022 -
Critical 9.8
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,…
KEV Nov 3, 2021 -
Critical 9.8
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic…
KEV Nov 3, 2021 -
Critical 9.8
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remot…
KEV Sep 30, 2024 -
Critical 9.8
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks …
KEV Feb 6, 2025 -
Critical 10.0
PAN-OS: Authentication Bypass in SAML Authentication
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-base…
KEV Mar 25, 2022 -
Medium 5.4
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
KEV Mar 3, 2022 -
High 7.8
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka …
KEV Nov 3, 2021 -
High 8.8CVE-2020-9818 Exploited
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13…
KEV Nov 3, 2021 -
Medium 4.3CVE-2020-9819 Exploited
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5…
KEV Nov 3, 2021 -
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024 -
High 7.8CVE-2020-9859 Exploited
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13…
KEV Nov 3, 2021 -
High 7.5
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send …
KEV Mar 25, 2022 -
Critical 9.1
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static …
KEV Dec 10, 2021 -
High 8.8
Command Injection in Kylin
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
KEV Mar 25, 2022 -
High 7.0
Win32k Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then…
KEV Nov 3, 2021 -
High 7.2
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute ar…
KEV Mar 10, 2023 -
Medium 4.3
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directorie…
KEV Nov 3, 2021 -
Critical 9.1
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary c…
KEV Nov 3, 2021 -
Critical 9.0
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…
KEV Nov 3, 2021 -
High 7.5
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could …
KEV Feb 15, 2024 -
Critical 9.8
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…
KEV Jun 22, 2023 -
High 8.8CVE-2020-1631 Exploited
Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI)…
KEV Mar 25, 2022 -
Medium 6.5
SaltStack Salt is vulnerable Arbitrary Directory Access
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
KEV Nov 3, 2021 -
Critical 9.8
SaltStack Salt Unauthenticated Remote Code Execution
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…
KEV Nov 3, 2021 -
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Critical 10.0
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as …
KEV Nov 3, 2021 -
High 8.1CVE-2020-6819 Exploited
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are a…
KEV Nov 3, 2021 -
High 8.1CVE-2020-6820 Exploited
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of …
KEV Nov 3, 2021 -
Critical 9.8
Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to…
KEV Nov 3, 2021 -
High 7.8CVE-2020-1027 Exploited
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windo…
KEV May 23, 2022 -
High 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 7.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Jan 7, 2025