Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,342
- Last 24h
- 681
- Critical, 7 days
- 356
- Known exploited
- 1,779
4,271 results · Clear filters · Feed
-
High 7.5CVE-2024-0760 Public exploit
A flood of DNS messages over TCP may make the server unstable
A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 vers…
-
High 7.1CVE-2024-7014 Public exploit
Improper multimedia file attachment validation in Telegram for Android app
EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.
-
High 8.8CVE-2024-41319 Public exploit
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter…
-
High 8.8CVE-2024-6244 Public exploit
pz-frontend-manager < 1.0.6 - CSRF change user profile picture
The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
-
High 8.4CVE-2024-34329 Public exploit
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch a…
-
High 8.2CVE-2024-40348 Public exploit
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a director…
-
High 8.1
Apache CloudStack: SAML Signature Exclusion
The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication…
-
High 7.6CVE-2024-6205 Public exploit
PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
-
High 7.1CVE-2024-40492 Public exploit
Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via th…
-
High 8.8CVE-2024-40119 Public exploit
Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery …
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Jun 1, 2026 -
High 8.8CVE-2024-6778 Public exploit
Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicio…
-
High 8.5CVE-2024-21513 Public exploit
langchain-experimental vulnerable to Arbitrary Code Execution
Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability an…
-
High 7.5
Django vulnerable to Denial of Service
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.
-
High 7.4CVE-2024-31320 Public exploit
In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association witho…
-
High 7.8CVE-2024-31317 Public exploit
In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SEC…
-
High 7.5
Windows MSHTML Platform Spoofing Vulnerability
Windows MSHTML Platform Spoofing Vulnerability
KEV Jul 9, 2024 -
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
KEV Jul 9, 2024 -
High 7.5CVE-2024-5633 Public exploit
Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attac…
-
High 7.8CVE-2024-39069 Public exploit
An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hi…
-
High 7.5CVE-2024-39689 Public exploit
Certifi removes GLOBALTRUST root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…
-
High 8.6CVE-2024-34361 Public exploit
Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlockl…
-
High 7.5CVE-2024-39210 Public exploit
Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page pa…
-
High 8.1
Apache HTTP Server proxy encoding problem
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, w…
-
High 7.5
Apache HTTP Server on WIndows UNC SSRF
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access…
-
High 7.5
Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
-
High 8.8CVE-2024-36985 Public exploit
Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.
-
High 7.5CVE-2024-36420 Public exploit
GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName…
-
High 8.1
Openssh: regresshion - race condition in ssh allows rce/dos
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate…
-
High 8.8CVE-2024-4007 Public exploit
Hard coded default credential contained in install package
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
-
High 8.8CVE-2024-37765 Public exploit
Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
-
High 8.8CVE-2024-39840 Public exploit
Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages th…
-
High 8.2CVE-2024-5736 Public exploit
SSRF in AdmirorFrames Joomla! Extension
Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.
-
High 8.4
WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
-
High 7.5
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.
-
High 8.2CVE-2024-37742 Public exploit
Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share cl…
-
High 7.4
SQL injection in opencart
This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment…
-
High 7.3CVE-2024-38355 Public exploit
Unhandled 'error' event in socket.io
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af2…
-
High 8.1
Remote code execution via JNDI resolution in JMX metrics collection in Kafka UI
Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying their network address and port. As a separate feature, it also provides the ability to monitor the performance of Kafk…
-
High 7.1CVE-2024-34444 Public exploit
WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0.