Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,817
- Last 24h
- 2,068
- Critical, 7 days
- 349
- Known exploited
- 1,779
1,796 results · Clear filters · Feed
-
Medium 6.1CVE-2025-59689 Exploited
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a…
KEV Sep 29, 2025 -
Critical 9.0
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shel…
KEV Nov 4, 2025 -
Critical 10.0
Deserialization Vulnerability in GoAnywhere MFT's License Servlet
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
KEV Sep 29, 2025 -
Critical 9.3
WatchGuard Firebox iked Out of Bounds Write Vulnerability
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when co…
KEV Nov 12, 2025 -
High 8.8CVE-2025-21043 Exploited
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitr…
KEV Oct 2, 2025 -
High 8.8
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitr…
KEV Nov 10, 2025 -
Critical 9.1
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality,…
KEV Oct 24, 2025 -
Critical 9.8
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…
KEV Sep 18, 2026 -
High 8.8
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use af…
KEV Sep 4, 2025 -
Critical 9.0
Sitecore Products ViewState Deserialization Vulnerability
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
KEV Sep 4, 2025 -
High 8.6
Authenticated RCE via Parental Control command injection
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products ha…
KEV Sep 3, 2025 -
Medium 5.4
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp B…
KEV Sep 2, 2025 -
Critical 10.0
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulatio…
KEV Aug 29, 2025 -
Critical 9.2
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC an…
KEV Aug 26, 2025 -
Critical 10.0
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS …
KEV Aug 21, 2025 -
Critical 9.4
Insecure Deserialization Vulnerability
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
KEV Aug 13, 2025 -
Critical 9.4CVE-2025-8876 Exploited
Command Injection Vulnerability
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
KEV Aug 13, 2025 -
High 7.5
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to g…
-
High 8.4
Path traversal vulnerability in WinRAR
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and …
KEV Aug 12, 2025 -
Critical 10.0
Adobe Experience Manager | Incorrect Authorization (CWE-863)
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of …
KEV Oct 15, 2025 -
Critical 9.4
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker…
KEV Aug 18, 2025 -
Critical 9.1
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
KEV Oct 28, 2025 -
High 8.0
Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
KEV Oct 28, 2025 -
High 8.8
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, ma…
KEV Mar 20, 2026 -
High 7.8
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …
KEV Sep 4, 2025 -
Critical 9.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a c…
KEV Jul 20, 2025 -
High 7.5
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
KEV Jan 22, 2026 -
Critical 9.0
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation an…
KEV Jul 22, 2025 -
Critical 9.2
Livewire vulnerable to remote command execution during property update hydration
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates …
KEV Mar 20, 2026 -
Critical 9.6
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerab…
KEV Jul 18, 2025 -
Critical 10.0
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerab…
KEV Jul 28, 2025 -
High 8.8
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote a…
KEV Jul 22, 2025 -
Critical 10.0
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection …
KEV Jul 14, 2025 -
Medium 4.3
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a…
KEV Mar 16, 2026 -
High 8.1
Git allows arbitrary code execution through broken config quoting
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). W…
KEV Aug 25, 2025 -
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
KEV Jul 22, 2025 -
High 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
KEV Jul 22, 2025 -
High 8.1
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write …
KEV Jul 2, 2025 -
Critical 9.3
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directo…
KEV Sep 29, 2025 -
Critical 10.0
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerab…
KEV Jul 28, 2025