Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,103
- Last 24h
- 529
- Critical, 7 days
- 343
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
Critical 9.9
TIBCO JasperReports Library Directory Traversal Vulnerability
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, …
KEV Dec 29, 2022 -
Medium 6.5CVE-2019-0676 Exploited
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker …
KEV May 23, 2022 -
Critical 9.8
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup…
KEV Nov 3, 2021 -
High 7.5CVE-2019-6223 Exploited
A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. …
KEV Nov 3, 2021 -
High 8.8
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public…
KEV Nov 3, 2021 -
High 8.1
Drupal core - Highly critical - Remote Code Execution
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions …
KEV Mar 25, 2022 -
High 7.5
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via …
KEV Nov 3, 2021 -
High 7.8
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field …
KEV Feb 15, 2022 -
Critical 9.8
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers…
KEV Apr 13, 2022 -
Critical 9.8
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that…
KEV May 24, 2022 -
High 7.2
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vu…
KEV Mar 3, 2022 -
High 7.5
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls …
KEV Nov 3, 2021 -
Medium 4.3
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 a…
KEV Sep 8, 2022 -
High 7.8
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successfu…
KEV Feb 15, 2022 -
High 8.8
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML …
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft …
KEV Mar 15, 2022 -
Critical 9.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
High 7.8
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8CVE-2018-19322 Exploited · Ransomware
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 8.4
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Mar 3, 2025 -
High 7.8
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka …
KEV May 24, 2022 -
Critical 9.8
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PH…
KEV Nov 3, 2021 -
High 8.8
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Ch…
KEV Jun 8, 2022 -
Critical 9.8
Deserialization of Untrusted Data in Jenkins
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by acce…
KEV Feb 10, 2022 -
Critical 9.8
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privil…
KEV Feb 4, 2025 -
High 8.8
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbi…
KEV Jun 8, 2022 -
High 8.8
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google C…
KEV Jun 8, 2022 -
High 7.4
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation o…
KEV Mar 3, 2022 -
High 7.8CVE-2018-8589 Exploited
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k…
KEV May 23, 2022 -
Critical 9.8
Richfaces vulnerable to arbitrary code execution
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4…
KEV Sep 28, 2023 -
Critical 9.8CVE-2018-14558 Exploited
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware thro…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Jan 21, 2022 -
High 7.8
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with …
KEV Jan 26, 2026 -
Critical 9.8
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (…
KEV Mar 28, 2022 -
High 8.1
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…
KEV Nov 3, 2021 -
High 7.8CVE-2018-8406 Exploited · Ransomware
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles obj…
KEV Mar 28, 2022 -
High 7.8CVE-2018-8405 Exploited · Ransomware
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles obj…
KEV Mar 28, 2022