Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,241
- Last 24h
- 581
- Critical, 7 days
- 356
- Known exploited
- 1,779
4,271 results · Clear filters · Feed
-
High 7.8
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating …
KEV Feb 5, 2025 -
High 7.5CVE-2024-20137 Public exploit
In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. This could…
-
High 8.0
An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability ex…
-
High 7.8CVE-2023-1521 Public exploit
Local Privilege Escalation in sccache
On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD. If the server is run as root (which is the default when installing the snap package https://…
-
High 8.8CVE-2024-11394 Public exploit
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is requir…
-
High 8.8CVE-2024-11393 Public exploit
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is …
-
High 7.5CVE-2024-11392 Public exploit
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is requi…
-
High 7.8
7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability
7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerabili…
-
High 8.1CVE-2024-5721 Public exploit
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to ex…
-
High 8.6CVE-2024-5716 Public exploit
Logsign Unified SecOps Platform Authentication Bypass Vulnerability
Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability…
-
High 8.1CVE-2024-10220 Public exploit
Arbitrary command execution through gitRepo volume
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
-
High 7.5
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL …
-
High 7.7CVE-2018-9468 Public exploit
In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This c…
-
High 8.8
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 1…
KEV Nov 21, 2024 -
High 8.8CVE-2018-9411 Public exploit
In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. This could l…
-
High 7.8CVE-2018-9338 Public exploit
In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check. Th…
-
High 7.8
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tri…
-
High 7.8
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which …
-
High 7.5CVE-2024-43416 Public exploit
GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the is…
-
High 7.5CVE-2024-11318 Public exploit
IDOR vulnerability in AbsysNet
An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifie…
-
High 7.8CVE-2024-50804 Public exploit
Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execu…
-
High 7.5CVE-2024-52940 Public exploit
AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address w…
-
High 8.8
PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and …
-
High 7.5CVE-2024-9935 Public exploit
PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download
The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the conte…
-
High 7.5CVE-2024-11237 Public exploit
TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow
A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack…
-
High 7.2CVE-2024-10793 Public exploit
WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated …
-
High 7.3CVE-2024-50986 Public exploit
An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.
-
High 8.8
Remote Code Execution in Gogs
Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.
-
High 8.7CVE-2024-52302 Public exploit
common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)
common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint a…
-
High 7.1CVE-2024-5082 Public exploit
Nexus Repository 2 - Remote Code Execution
A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
-
High 7.5CVE-2024-50968 Public exploit
A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1…
-
High 8.0CVE-2024-52550 Public exploit
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build who…
-
High 7.3
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to pre…
KEV Nov 7, 2024 -
High 7.5CVE-2024-51996 Public exploit
Symphony has an Authentication Bypass via RememberMe
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie…
-
High 8.8CVE-2024-10629 Public exploit
GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation
The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.9. This makes it possible for authenticated at…
-
High 8.7
Laravel allows environment manipulation via query string
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerabi…
-
High 7.1CVE-2024-23666 Public exploit
A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 th…
-
High 8.8
Windows Task Scheduler Elevation of Privilege Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
KEV Nov 12, 2024 -
High 7.8CVE-2024-49019 Public exploit
Active Directory Certificate Services Elevation of Privilege Vulnerability
Active Directory Certificate Services Elevation of Privilege Vulnerability
-
High 7.8CVE-2024-43630 Public exploit
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability