Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 409,103
Last 24h: 563
Critical, 7 days: 346
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

1,796 results · Clear filters · Feed

High 7.8

CVE-2019-2215 Exploited Public exploit EPSS 72%

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interact…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Oct 11, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1322 Exploited · Ransomware Public exploit EPSS 19%

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Oct 10, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1315 Exploited · Ransomware Public exploit

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Oct 10, 2019
KEV Mar 15, 2022
Critical 9.8

CVE-2019-16928 Exploited EPSS 42%

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-b…

exim4 exim Debian Alpine

Sep 27, 2019
KEV Mar 3, 2022
Critical 9.8

CVE-2019-16920 Exploited Public exploit EPSS 100%

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The …

Sep 27, 2019
KEV Mar 25, 2022
Critical 9.8

CVE-2019-16759 Exploited Public exploit EPSS 100%

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widg…

Sep 24, 2019
KEV Nov 3, 2021
High 7.5

CVE-2019-1367 Exploited · Ransomware Public exploit EPSS 52%

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

Microsoft Internet Explorer 11 Internet Explorer 10 Internet Explorer 9 Windows

Sep 23, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-16057 Exploited · Ransomware EPSS 86%

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

Sep 16, 2019
KEV Apr 15, 2022
Critical 9.8

CVE-2019-16256 Exploited

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote at…

Sep 12, 2019
KEV Nov 3, 2021
High 8.8

CVE-2019-1297 Exploited EPSS 22%

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obj…

Microsoft Microsoft Office Office 365 ProPlus Microsoft Excel

Sep 11, 2019
KEV Mar 3, 2022
High 7.8

CVE-2019-1253 Exploited · Ransomware Public exploit EPSS 12%

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Sep 11, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1215 Exploited · Ransomware Public exploit EPSS 19%

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Wi…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Sep 11, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-1214 Exploited

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Sep 11, 2019
KEV Nov 3, 2021
High 8.8

CVE-2019-15949 Exploited Public exploit EPSS 77%

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios…

Sep 5, 2019
KEV Nov 3, 2021
High 7.5

CVE-2019-13608 Exploited · Ransomware EPSS 30%

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE a…

Aug 29, 2019
KEV Nov 3, 2021
High 7.8

CVE-2019-15752 Exploited Public exploit EPSS 49%

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-…

Aug 28, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-15107 Exploited · Ransomware Public exploit EPSS 100%

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…

Aug 16, 2019
KEV Mar 25, 2022
Critical 9.8

CVE-2019-0344 Exploited

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 18…

SAP_SE SAP Commerce Cloud (virtualjdbc extension)

Aug 14, 2019
KEV Sep 30, 2024
Critical 9.8

CVE-2019-11581 Exploited Public exploit EPSS 85%

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

Atlassian Jira Server and Data Center Web / CMS

Aug 9, 2019
KEV Mar 7, 2022
High 7.2

CVE-2019-0193 Exploited Public exploit EPSS 84%

XML External Entity (XXE) Injection in Apache Solr

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen…

Apache Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven

Aug 1, 2019
KEV Dec 10, 2021
High 7.8

CVE-2019-1132 Exploited Public exploit

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

Microsoft Windows Windows Server Windows

Jul 29, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1130 Exploited · Ransomware

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Jul 29, 2019
KEV May 23, 2022
High 7.8

CVE-2019-1129 Exploited · Ransomware

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Jul 29, 2019
KEV Mar 15, 2022
High 8.8

CVE-2019-11707 Exploited Public exploit EPSS 38%

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jul 23, 2019
KEV May 23, 2022
Critical 10.0

CVE-2019-11708 Exploited Public exploit EPSS 56%

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jul 23, 2019
KEV May 23, 2022
High 8.1

CVE-2019-1579 Exploited · Ransomware Public exploit EPSS 44%

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…

Jul 19, 2019
KEV Jan 10, 2022
High 7.8

CVE-2019-13272 Exploited Public exploit EPSS 52%

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proc…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 17, 2019
KEV Dec 10, 2021
Critical 9.8

CVE-2019-12989 Exploited Public exploit EPSS 95%

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

Jul 16, 2019
KEV Mar 25, 2022
High 8.8

CVE-2019-12991 Exploited Public exploit EPSS 74%

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of…

Jul 16, 2019
KEV Mar 25, 2022
High 8.8

CVE-2019-1068 Exploited Public exploit EPSS 57%

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal…

Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) Microsoft SQL Server Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)

Jul 15, 2019
KEV Aug 26, 2026
High 7.8

CVE-2019-0880 Exploited

A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Jul 15, 2019
KEV May 23, 2022
High 7.5

CVE-2018-18325 Exploited Public exploit EPSS 74%

Inadequate Encryption Strength in DotNetNuke

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

DotNetNuke.Core NuGet

Jul 3, 2019
KEV Nov 3, 2021
High 7.5

CVE-2018-15811 Exploited Public exploit EPSS 76%

Inadequate Encryption Strength in DotNetNuke

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

DotNetNuke.Core NuGet

Jul 3, 2019
KEV Nov 3, 2021
Critical 9.8

CVE-2019-7256 Exploited Public exploit EPSS 97%

Linear eMerge E3-Series devices allow Command Injections.

Jul 2, 2019
KEV Mar 25, 2024
Medium 6.5

CVE-2019-5786 Exploited Public exploit EPSS 61%

Use-After-Free in puppeteer

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm

Jun 27, 2019
KEV May 23, 2022
High 7.8

CVE-2019-1064 Exploited · Ransomware Public exploit

Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install p…

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 12, 2019
KEV Mar 15, 2022
High 7.8

CVE-2019-1069 Exploited · Ransomware Public exploit

Task Scheduler Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, a…

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 12, 2019
KEV Mar 15, 2022
Critical 9.8

CVE-2010-5330 Exploited EPSS 40%

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the i…

Jun 11, 2019
KEV Apr 15, 2022
Critical 9.0

CVE-2019-10149 Exploited Public exploit EPSS 100%

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message…

Exim Exim exim4 exim4 Debian Ubuntu Alpine

Jun 5, 2019
KEV Jan 10, 2022
Critical 9.1

CVE-2018-13382 Exploited · Ransomware Public exploit EPSS 82%

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and Fort…

Fortinet Fortinet FortiOS, FortiProxy Network devices

Jun 4, 2019
KEV Jan 10, 2022

Latest vulnerabilities

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interact…

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft …

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-b…

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The …

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widg…

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote at…

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obj…

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Wi…

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles…

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios…

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE a…

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-…

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 18…

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

XML External Entity (XXE) Injection in Apache Solr

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proc…

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of…

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal…

A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 …

Inadequate Encryption Strength in DotNetNuke

Inadequate Encryption Strength in DotNetNuke

Linear eMerge E3-Series devices allow Command Injections.

Use-After-Free in puppeteer

Windows Elevation of Privilege Vulnerability

Task Scheduler Elevation of Privilege Vulnerability

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the i…

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message…

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and Fort…