Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 409,354
Last 24h: 664
Critical, 7 days: 338
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

931 results · Clear filters · Feed

High 8.8

CVE-2020-24363 Exploited Public exploit EPSS 22%

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDD…

Aug 31, 2020
KEV Sep 2, 2025
High 8.6

CVE-2020-3566 Exploited

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue manageme…

Cisco Cisco IOS XR Software iOS Network devices

Aug 29, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-9715 Exploited Public exploit EPSS 33%

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.…

Adobe Adobe Acrobat and Reader

Aug 19, 2020
KEV Apr 13, 2026
High 7.8

CVE-2020-1464 Exploited EPSS 39%

Windows Spoofing Vulnerability

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass secu…

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Aug 17, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-1380 Exploited EPSS 24%

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current …

Microsoft Internet Explorer 11

Aug 17, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-3433 Exploited · Ransomware Public exploit EPSS 10%

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to ha…

Cisco Cisco AnyConnect Secure Mobility Client Network devices

Aug 17, 2020
KEV Oct 24, 2022
High 7.2

CVE-2020-8218 Exploited Public exploit EPSS 32%

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perfor…

Jul 30, 2020
KEV Mar 7, 2022
High 7.5

CVE-2020-12812 Exploited · Ransomware EPSS 45%

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a u…

Jul 24, 2020
KEV Nov 3, 2021
High 7.5

CVE-2020-3452 Exploited Public exploit Scanner template EPSS 100%

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files…

Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices

Jul 22, 2020
KEV Nov 3, 2021
High 8.8

CVE-2020-11978 Exploited Public exploit Scanner template EPSS 99%

Remote code execution (RCE) in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…

Apache Software Foundation Apache Airflow apache-airflow PyPI

Jul 16, 2020
KEV Jan 18, 2022
High 7.8

CVE-2020-1147 Exploited Public exploit EPSS 96%

.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulne…

Microsoft Microsoft SharePoint Server Microsoft SharePoint Enterprise Server Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Windows NuGet

Jul 14, 2020
KEV Nov 3, 2021
High 8.8

CVE-2020-9377 Exploited EPSS 22%

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability on…

Jul 9, 2020
KEV Mar 25, 2022
High 7.8

CVE-2020-0986 Exploited EPSS 16%

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Jun 9, 2020
KEV Nov 3, 2021
High 8.8

CVE-2020-9818 Exploited

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13…

Apple watchOS iOS iOS-1 iOS

Jun 9, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-9859 Exploited

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13…

Apple macOS watchOS tvOS macOS iOS

Jun 5, 2020
KEV Nov 3, 2021
High 7.5

CVE-2020-5410 Exploited Public exploit Scanner template EPSS 96%

Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send …

Spring by VMware Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven

Jun 2, 2020
KEV Mar 25, 2022
High 8.8

CVE-2020-1956 Exploited Public exploit Scanner template EPSS 97%

Command Injection in Kylin

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Apache Kylin org.apache.kylin:kylin-core-common Maven

May 22, 2020
KEV Mar 25, 2022
High 7.0

CVE-2020-1054 Exploited Public exploit EPSS 54%

Win32k Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then…

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

May 21, 2020
KEV Nov 3, 2021
High 7.2

CVE-2020-5741 Exploited Public exploit EPSS 73%

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute ar…

Windows

May 8, 2020
KEV Mar 10, 2023
High 7.5

CVE-2020-3259 Exploited · Ransomware EPSS 72%

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could …

Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices

May 6, 2020
KEV Feb 15, 2024
High 8.8

CVE-2020-1631 Exploited

Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI)…

Juniper Networks Junos OS Network devices

May 4, 2020
KEV Mar 25, 2022
High 8.1

CVE-2020-6819 Exploited

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are a…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Apr 24, 2020
KEV Nov 3, 2021
High 8.1

CVE-2020-6820 Exploited

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of …

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Apr 24, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-1027 Exploited

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windo…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Apr 15, 2020
KEV May 23, 2022
High 8.8

CVE-2020-1020 Exploited Public exploit EPSS 65%

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Apr 15, 2020
KEV Nov 3, 2021
High 7.5

CVE-2020-0968 Exploited · Ransomware EPSS 31%

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

Microsoft Internet Explorer 11 Internet Explorer 9 Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems Windows

Apr 15, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-0938 Exploited EPSS 69%

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Apr 15, 2020
KEV Nov 3, 2021
High 7.5

CVE-2020-11738 Exploited Public exploit Scanner template EPSS 98%

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Trave…

Apr 13, 2020
KEV Nov 3, 2021
High 8.8

CVE-2020-5735 Exploited Public exploit EPSS 36%

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attack…

Apr 8, 2020
KEV Nov 3, 2021
High 8.8

CVE-2020-10199 Exploited Public exploit Scanner template EPSS 99%

Nexus Repository Manager 3 - Remote Code Execution

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

org.sonatype.nexus:nexus-extdirect Maven

Apr 1, 2020
KEV Nov 3, 2021
High 8.8

CVE-2020-8467 Exploited EPSS 11%

A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow …

Trend Micro Trend Micro OfficeScan, Trend Micro Apex One

Mar 18, 2020
KEV Nov 3, 2021
High 8.8

CVE-2020-8468 Exploited

Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a c…

Trend Micro Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS)

Mar 18, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-3950 Exploited Public exploit

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for…

Mar 17, 2020
KEV Nov 3, 2021
High 7.5

CVE-2020-5849 Exploited Public exploit EPSS 93%

Unraid 6.8.0 allows authentication bypass.

Mar 16, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-0787 Exploited · Ransomware Public exploit EPSS 43%

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improper…

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows

Mar 12, 2020
KEV Jan 28, 2022
High 7.8

CVE-2020-0069 Exploited Public exploit

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient…

Android

Mar 10, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-0041 Exploited Public exploit

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could…

linux-hwe linux-riscv linux linux-gke Android Debian Ubuntu

Mar 10, 2020
KEV Nov 3, 2021
High 7.2

CVE-2016-11021 Exploited Public exploit EPSS 70%

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in t…

Mar 9, 2020
KEV Mar 25, 2022
High 8.8

CVE-2020-10221 Exploited Public exploit Scanner template EPSS 77%

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands v…

Mar 8, 2020
KEV Nov 3, 2021
High 7.8

CVE-2019-20500 Exploited Public exploit EPSS 97%

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configur…

Mar 5, 2020
KEV Jun 29, 2023

Latest vulnerabilities

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDD…

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.…

Windows Spoofing Vulnerability

Scripting Engine Memory Corruption Vulnerability

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perfor…

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a u…

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

Remote code execution (RCE) in Apache Airflow

.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability on…

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka …

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13…

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13…

Directory Traversal with spring-cloud-config-server

Command Injection in Kylin

Win32k Elevation of Privilege Vulnerability

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute ar…

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability

Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are a…

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of …

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windo…

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Trave…

Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attack…

Nexus Repository Manager 3 - Remote Code Execution

A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow …

Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a c…

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for…

Unraid 6.8.0 allows authentication bypass.

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improper…

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient…

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could…

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in t…

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands v…

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configur…