Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,413
- Last 24h
- 637
- Critical, 7 days
- 337
- Known exploited
- 1,779
4,273 results · Clear filters · Feed
-
High 8.8
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of…
KEV Mar 25, 2022 -
High 8.8
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal…
KEV Aug 26, 2026 -
High 7.8CVE-2019-13574 Public exploit
OS Command Injection in MiniMagick
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
-
High 7.8CVE-2019-0053 Public exploit
Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of envir…
-
High 7.5
Insufficient Entropy in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.
-
High 7.5
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
KEV Nov 3, 2021 -
High 7.5
Insufficient Entropy in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
-
High 7.5
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
KEV Nov 3, 2021 -
High 7.5
Cisco Data Center Network Manager Arbitrary File Download Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settin…
-
High 7.5
Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fi…
-
High 7.8
Windows Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install p…
KEV Mar 15, 2022 -
High 7.8
Task Scheduler Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, a…
KEV Mar 15, 2022 -
High 8.5
Microsoft Windows Security Feature Bypass Vulnerability
A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this vulnerability, an attacker could send a specially crafted authentication request. An attacker who successfully exploit…
-
High 8.8
ActiveX Data Objects (ADO) Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with the victim user’s privileges. An attacker could craft …
-
High 7.0CVE-2019-0959 Public exploit
Windows Common Log File System Driver Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit the vul…
-
High 7.6CVE-2019-0709 Public exploit
Windows Hyper-V Remote Code Execution Vulnerability
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on …
-
High 7.5CVE-2018-7852 Public exploit
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …
-
High 7.5
Information exposure in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…
-
High 7.8
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Err…
KEV Nov 3, 2021 -
High 8.8
Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating …
-
High 7.5CVE-2019-10742 Public exploit
Denial of Service in axios
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
-
High 7.8CVE-2019-11687 Public exploit
An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing i…
-
High 7.5
Server Side Request Forgery in Apache Axis
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from so…
-
High 7.5
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x …
KEV Jul 7, 2025 -
High 7.4CVE-2019-5624 Public exploit
Rapid7 Metasploit Framework Zip Import Directory Traversal
Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary c…
-
High 7.5
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Support…
KEV Jan 10, 2022 -
High 8.0
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1…
KEV Nov 3, 2021 -
High 7.2
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publ…
KEV Mar 25, 2022 -
High 8.8
Local privilege escalation via snapd socket
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
-
High 7.5CVE-2019-5427 Public exploit
Billion laughs attack in c3p0
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
-
High 7.1
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated …
-
High 8.8
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote a…
KEV Nov 3, 2021 -
High 7.7CVE-2017-11427 Public exploit
Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the atta…
-
High 8.1
Apache Tomcat OS Command Injection vulnerability
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windo…
-
High 8.1
Gitea Remote Code Execution
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
-
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV Mar 15, 2022 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Feb 15, 2022 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021