Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 409,103
Last 24h: 570
Critical, 7 days: 347
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,796 results · Clear filters · Feed

Critical 9.8

CVE-2020-7247 Exploited Public exploit EPSS 99%

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…

opensmtpd opensmtpd opensmtpd Debian Ubuntu Alpine

Jan 29, 2020
KEV Mar 25, 2022
High 8.2

CVE-2019-18426 Exploited Public exploit EPSS 68%

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…

Facebook WhatsApp Desktop

Jan 21, 2020
KEV May 23, 2022
Critical 9.8

CVE-2020-2551 Exploited Public exploit EPSS 93%

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppo…

Oracle WebLogic Server

Jan 15, 2020
KEV Nov 16, 2023
Critical 9.8

CVE-2020-2555 Exploited Public exploit EPSS 97%

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). S…

Oracle WebCenter Portal Utilities Framework

Jan 15, 2020
KEV Nov 3, 2021
Critical 9.8

CVE-2020-0646 Exploited Public exploit EPSS 99%

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.…

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.5.1 Windows

Jan 14, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-0638 Exploited · Ransomware

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Jan 14, 2020
KEV May 23, 2022
High 8.1

CVE-2020-0601 Exploited Public exploit EPSS 89%

Certificate validation bypass on Windows in crypto/x509

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows Alpine Go

Jan 14, 2020
KEV Nov 3, 2021
High 7.5

CVE-2019-17558 Exploited Public exploit EPSS 99%

Improper Input Validation in Apache Solr

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configse…

org.apache.solr:solr-core lucene-solr Debian Maven

Dec 30, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-17621 Exploited Public exploit EPSS 91%

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated re…

Dec 30, 2019
KEV Jun 29, 2023
High 7.5

CVE-2019-20085 Exploited Public exploit EPSS 96%

TVT NVMS-1000 devices allow GET /.. Directory Traversal

Dec 30, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-19781 Exploited · Ransomware Public exploit EPSS 100%

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. T…

Dec 27, 2019
KEV Nov 3, 2021
Critical 9.9

CVE-2019-10758 Exploited Public exploit EPSS 85%

Remote Code Execution Vulnerability in NPM mongo-express

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

mongo-express npm

Dec 24, 2019
KEV Dec 10, 2021
High 7.5

CVE-2019-7483 Exploited

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user …

SonicWall SMA100 Network devices

Dec 19, 2019
KEV Mar 28, 2022
High 7.8

CVE-2019-8605 Exploited Public exploit EPSS 18%

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…

Apple macOS watchOS tvOS macOS iOS

Dec 18, 2019
KEV Jun 27, 2022
High 7.8

CVE-2019-7286 Exploited Public exploit EPSS 16%

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…

Apple macOS iOS macOS iOS

Dec 18, 2019
KEV May 23, 2022
High 7.8

CVE-2019-8526 Exploited

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An a…

Apple macOS macOS

Dec 18, 2019
KEV Apr 17, 2023
High 8.8

CVE-2019-8506 Exploited Public exploit EPSS 16%

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…

Apple watchOS tvOS Safari Windows iOS Browsers Debian Ubuntu Alpine

Dec 18, 2019
KEV May 4, 2022
High 7.8

CVE-2019-7287 Exploited

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicati…

Apple iOS iOS

Dec 18, 2019
KEV May 23, 2022
Critical 10.0

CVE-2019-4716 Exploited Public exploit EPSS 86%

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…

IBM Planning Analytics

Dec 18, 2019
KEV Nov 3, 2021
High 7.5

CVE-2019-7481 Exploited · Ransomware EPSS 100%

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This v…

SonicWall SMA100 Network devices

Dec 17, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-18935 Exploited · Ransomware Public exploit EPSS 100%

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

Dec 11, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1458 Exploited · Ransomware Public exploit EPSS 74%

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

Microsoft Windows Windows Server Windows

Dec 10, 2019
KEV Jan 10, 2022
Critical 9.8

CVE-2019-5544 Exploited · Ransomware Public exploit EPSS 98%

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…

openslp-dfsg Virtualization Ubuntu

Dec 6, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-7195 Exploited · Ransomware Public exploit EPSS 89%

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

Dec 5, 2019
KEV Jun 8, 2022
Critical 9.8

CVE-2019-7194 Exploited · Ransomware Public exploit EPSS 83%

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

Dec 5, 2019
KEV Jun 8, 2022
Critical 9.8

CVE-2019-7193 Exploited · Ransomware EPSS 14%

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the…

Dec 5, 2019
KEV Jun 8, 2022
Critical 9.8

CVE-2019-7192 Exploited · Ransomware Public exploit EPSS 88%

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…

Dec 5, 2019
KEV Jun 8, 2022
High 8.8

CVE-2019-15271 Exploited

Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an ac…

Cisco Cisco Small Business RV Series Router Firmware Network devices

Nov 26, 2019
KEV Jun 8, 2022
Medium 6.5

CVE-2019-5825 Exploited Public exploit EPSS 56%

Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 25, 2019
KEV Jun 8, 2022
High 8.8

CVE-2019-13720 Exploited Public exploit EPSS 49%

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 25, 2019
KEV May 23, 2022
Critical 9.8

CVE-2019-19006 Exploited EPSS 55%

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Nov 21, 2019
KEV Feb 3, 2026
Medium 6.5

CVE-2019-6693 Exploited · Ransomware Public exploit

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attack…

Fortinet FortiGate Network devices

Nov 21, 2019
KEV Jun 25, 2025
High 7.5

CVE-2019-1429 Exploited Public exploit EPSS 77%

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

Microsoft Internet Explorer 11 Internet Explorer 9 Internet Explorer 10 Windows

Nov 12, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1405 Exploited · Ransomware Public exploit EPSS 30%

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allow…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Nov 12, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1385 Exploited · Ransomware

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privileg…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Nov 12, 2019
KEV May 23, 2022
High 7.8

CVE-2019-1388 Exploited · Ransomware Public exploit

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Nov 12, 2019
KEV Apr 7, 2023
High 8.8

CVE-2019-18187 Exploited EPSS 25%

Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vu…

Trend Micro Trend Micro OfficeScan

Oct 28, 2019
KEV Nov 3, 2021
High 8.7

CVE-2019-11043 Exploited · Ransomware Public exploit EPSS 100%

Underflow in PHP-FPM can lead to RCE

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibilit…

php php php5 php7.0 Ubuntu Alpine

Oct 28, 2019
KEV Mar 25, 2022
High 8.8

CVE-2019-3010 Exploited Public exploit EPSS 14%

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is …

Oracle Solaris Operating System

Oct 16, 2019
KEV May 25, 2022
Critical 9.8

CVE-2019-16278 Exploited Public exploit EPSS 99%

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…

Oct 14, 2019
KEV Nov 7, 2024

Latest vulnerabilities

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to…

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppo…

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). S…

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.…

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this…

Certificate validation bypass on Windows in crypto/x509

Improper Input Validation in Apache Solr

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated re…

TVT NVMS-1000 devices allow GET /.. Directory Traversal

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. T…

Remote Code Execution Vulnerability in NPM mongo-express

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user …

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave…

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An a…

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS…

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicati…

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated us…

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This v…

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncU…

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To f…

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the…

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix th…

Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability

Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap…

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attack…

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allow…

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privileg…

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user…

Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vu…

Underflow in PHP-FPM can lead to RCE

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is …

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…