Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,342
- Last 24h
- 681
- Critical, 7 days
- 356
- Known exploited
- 1,779
4,271 results · Clear filters · Feed
-
High 8.0CVE-2024-45264 Public exploit
A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remot…
-
High 7.5
A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allo…
-
High 8.0CVE-2024-42845 Public exploit
An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 a…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a…
KEV Aug 26, 2024 -
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exp…
KEV Aug 28, 2024 -
High 8.8CVE-2024-7966 Public exploit
Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromis…
-
High 7.5CVE-2023-29929 Public exploit
Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue …
-
High 7.6CVE-2024-21689 Public exploit
This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9…
-
High 7.6CVE-2024-35540 Public exploit
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts o…
-
High 7.5CVE-2024-44083 Public exploit
ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jum…
-
High 7.5CVE-2024-42657 Public exploit
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information …
-
High 8.8CVE-2024-42658 Public exploit
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information …
-
High 8.8
CVE-2024-7646 in github.com/kubernetes/ingress-nginx
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the in…
-
High 7.7CVE-2024-34740 Public exploit
In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection …
-
High 7.8CVE-2024-34741 Public exploit
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be vi…
-
High 7.8CVE-2024-34739 Public exploit
In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a…
-
High 7.3CVE-2024-7808 Public exploit
code-projects Job Portal logindbc.php sql injection
A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file logindbc.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotel…
-
High 8.8
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
-
High 7.8CVE-2024-38127 Public exploit
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
-
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
KEV Aug 13, 2024 -
High 7.1CVE-2024-40892 Public exploit
Firewalla BTLE Weak Credentials
A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interfa…
-
High 8.2CVE-2024-36877 Public exploit
Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and …
-
High 8.3CVE-2024-42370 Public exploit
Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This…
-
High 8.8
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before …
KEV Apr 24, 2026 -
High 7.4CVE-2024-42365 Public exploit
Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration …
-
High 8.8
Jenkins Remoting library arbitrary file read vulnerability
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
-
High 7.9CVE-2024-21980 Public exploit
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a …
-
High 8.1
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of …
KEV Aug 27, 2024 -
High 8.6CVE-2024-39713 Public exploit
Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
-
High 8.8
Command Injection in AVTech AVM1203 (IP Camera)
Commands can be injected over the network and executed without authentication.
-
High 8.4CVE-2024-41127 Public exploit
Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.
Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comm…
-
High 7.2CVE-2024-33896 Public exploit
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection du…
-
High 7.1CVE-2024-6529 Public exploit
Ultimate Classified Listings < 1.4 - Reflected XSS
The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
High 7.5CVE-2024-40815 Public exploit
A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonom…
-
High 7.0CVE-2024-41817 Public exploit
Arbitrary Code Execution in `AppImage` version `ImageMagick`
ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executi…
-
High 8.8CVE-2024-39304 Public exploit
ChurchCRM SQL Injection Vulnerability
ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessa…
-
High 7.1CVE-2024-41357 Public exploit
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
-
High 7.5CVE-2024-41628 Public exploit
Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and…
-
High 7.2CVE-2024-40318 Public exploit
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via upload…
-
High 8.6CVE-2024-41662 Public exploit
VNote vulnerable to Markdown XSS, which leads to RCE
VNote is a note-taking platform. A Cross-Site Scripting (XSS) vulnerability has been identified in the Markdown rendering functionality of versions 3.18.1 and prior of the VNote note-taking application. This vulnerability allows the injection and execution of…