Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,354
- Last 24h
- 664
- Critical, 7 days
- 338
- Known exploited
- 1,779
4,273 results · Clear filters · Feed
-
High 8.8
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the …
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
-
High 8.8
Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.
-
High 7.2
Authenticated Command Injection in NetModule NSRW
NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 be…
-
High 7.8CVE-2023-0860 Public exploit
Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
-
High 7.8
Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
KEV Feb 14, 2023 -
High 7.8CVE-2023-21688 Public exploit
NT OS Kernel Elevation of Privilege Vulnerability
NT OS Kernel Elevation of Privilege Vulnerability
-
High 7.8CVE-2023-21817 Public exploit
Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
High 8.8
An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the…
-
High 8.6
Authentication Bypass by Primary Weakness in modoboa/modoboa
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
-
High 8.8CVE-2022-46649 Public exploit
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to …
-
High 7.4
X.400 address type confusion in X.509 GeneralName
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…
-
High 8.8
Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect
A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security prot…
-
High 7.2
Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
KEV Feb 10, 2023 -
High 8.8CVE-2022-46604 Public exploit
An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechani…
-
High 8.8
D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the la…
-
High 8.8CVE-2023-24610 Public exploit
NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. Th…
-
High 8.8CVE-2022-45782 Public exploit
An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure…
-
High 7.9
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …
KEV Mar 30, 2023 -
High 7.6CVE-2023-0455 Public exploit
Unrestricted Upload of File with Dangerous Type in unilogies/bumsys
Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.
-
High 7.8CVE-2022-45770 Public exploit
Improper input validation in adgnetworkwfpdrv.sys in Adguard For Windows x86 through 7.11 allows local privilege escala…
-
High 7.8
Path Traversal in binwalk
A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is r…
-
High 8.8CVE-2023-24422 Public exploit
Sandbox bypass in Jenkins Script Security Plugin
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…
-
High 7.8CVE-2023-20904 Public exploit
In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mism…
-
High 7.3CVE-2023-20921 Public exploit
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility se…
-
High 7.8CVE-2022-45639 Public exploit
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cr…
-
High 7.8CVE-2022-20493 Public exploit
In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. …
-
High 7.5
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
-
High 7.5CVE-2022-38725 Public exploit
An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a…
-
High 7.3CVE-2023-24059 Public exploit
Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploit…
-
High 7.8
Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…
KEV Oct 10, 2023 -
High 7.8
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…
-
High 7.5CVE-2022-46505 Public exploit
An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the m…
-
High 7.5
Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.
-
High 7.5CVE-2021-36630 Public exploit
DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote a…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV May 1, 2023 -
High 7.5CVE-2023-21837 Public exploit
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 7.5CVE-2022-40319 Public exploit
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a…
-
High 7.2
Command Injection in froxlor/froxlor
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.