Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,453
- Last 24h
- 637
- Critical, 7 days
- 339
- Known exploited
- 1,779
931 results · Clear filters · Feed
-
High 8.8
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios…
KEV Nov 3, 2021 -
High 7.5
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE a…
KEV Nov 3, 2021 -
High 7.8
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-…
KEV Nov 3, 2021 -
High 7.2
XML External Entity (XXE) Injection in Apache Solr
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen…
KEV Dec 10, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Mar 15, 2022 -
High 7.8CVE-2019-1130 Exploited · Ransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV May 23, 2022 -
High 7.8CVE-2019-1129 Exploited · Ransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV Mar 15, 2022 -
High 8.8
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…
KEV May 23, 2022 -
High 8.1
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glo…
KEV Jan 10, 2022 -
High 7.8
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proc…
KEV Dec 10, 2021 -
High 8.8
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of…
KEV Mar 25, 2022 -
High 8.8
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal…
KEV Aug 26, 2026 -
High 7.8CVE-2019-0880 Exploited
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 …
KEV May 23, 2022 -
High 7.5
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
KEV Nov 3, 2021 -
High 7.5
Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
KEV Nov 3, 2021 -
High 7.8
Windows Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install p…
KEV Mar 15, 2022 -
High 7.8
Task Scheduler Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, a…
KEV Mar 15, 2022 -
High 8.8
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to e…
KEV Mar 26, 2025 -
High 8.8
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles object…
KEV Mar 25, 2022 -
High 7.8
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Err…
KEV Nov 3, 2021 -
High 8.8
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES…
KEV Dec 12, 2025 -
High 7.5
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x …
KEV Jul 7, 2025 -
High 7.5
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Support…
KEV Jan 10, 2022 -
High 8.0
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1…
KEV Nov 3, 2021 -
High 7.2
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publ…
KEV Mar 25, 2022 -
High 8.8
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote a…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV Mar 15, 2022 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Feb 15, 2022 -
High 7.8CVE-2019-0797 Exploited
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.8
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…
KEV Nov 3, 2021 -
High 7.2
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the…
KEV Dec 18, 2024 -
High 7.8CVE-2018-4344 Exploited
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, ma…
KEV Jun 27, 2022 -
High 7.5
Path Traversal in Action View
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
KEV Jul 7, 2025 -
High 7.5CVE-2019-6223 Exploited
A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. …
KEV Nov 3, 2021 -
High 8.8
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public…
KEV Nov 3, 2021 -
High 8.1
Drupal core - Highly critical - Remote Code Execution
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions …
KEV Mar 25, 2022 -
High 7.5
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via …
KEV Nov 3, 2021