Latest vulnerabilities

931 results · Clear filters · Feed

• High 7.2
  CVE-2023-35081 Exploited EPSS 64%

  A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) a…

  ivanti EPMM Network devices
  Aug 3, 2023

  KEV Jul 31, 2023
• High 7.5
  CVE-2023-38950 Exploited EPSS 92%

  A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbi…

  Aug 3, 2023

  KEV May 19, 2025
• High 8.8
  CVE-2023-37450 Exploited EPSS 19%

  The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jul 26, 2023

  KEV Jul 13, 2023
• High 7.5
  CVE-2023-29298 Exploited EPSS 100%

  Adobe ColdFusion Improper Access Control Security feature bypass

  Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to a…

  Adobe ColdFusion
  Jul 12, 2023

  KEV Jul 20, 2023
• High 7.5
  CVE-2023-36884 Exploited · Ransomware Public exploit EPSS 99%

  Windows Search Remote Code Execution Vulnerability

  Windows Search Remote Code Execution Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jul 11, 2023

  KEV Jul 17, 2023
• High 8.8
  CVE-2023-35311 Exploited EPSS 16%

  Microsoft Outlook Security Feature Bypass Vulnerability

  Microsoft Outlook Security Feature Bypass Vulnerability

  Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019
  Jul 11, 2023

  KEV Jul 11, 2023
• High 7.8
  CVE-2023-36874 Exploited Public exploit EPSS 44%

  Windows Error Reporting Service Elevation of Privilege Vulnerability

  Windows Error Reporting Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jul 11, 2023

  KEV Jul 11, 2023
• High 8.8
  CVE-2023-32049 Exploited

  Windows SmartScreen Security Feature Bypass Vulnerability

  Windows SmartScreen Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jul 11, 2023

  KEV Jul 11, 2023
• High 7.8
  CVE-2023-32046 Exploited

  Windows MSHTML Platform Elevation of Privilege Vulnerability

  Windows MSHTML Platform Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jul 11, 2023

  KEV Jul 11, 2023
• High 7.8
  CVE-2023-32434 Exploited Public exploit EPSS 58%

  An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 1…

  Apple macOS iOS and iPadOS watchOS macOS iOS
  Jun 23, 2023

  KEV Jun 23, 2023
• High 8.6
  CVE-2023-32409 Exploited EPSS 17%

  The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4,…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jun 23, 2023

  KEV May 22, 2023
• High 8.8
  CVE-2023-32435 Exploited EPSS 23%

  A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safa…

  Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu
  Jun 23, 2023

  KEV Jun 23, 2023
• High 8.8
  CVE-2023-32373 Exploited EPSS 12%

  A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, ma…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jun 23, 2023

  KEV May 22, 2023
• High 8.8
  CVE-2023-32439 Exploited EPSS 24%

  A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.…

  Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu
  Jun 23, 2023

  KEV Jun 23, 2023
• High 8.4
  CVE-2023-2533 Exploited EPSS 29%

  PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

  A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an a…

  PaperCut PaperCut NG/MF
  Jun 20, 2023

  KEV Jul 28, 2025
• High 8.4
  CVE-2023-29360 Exploited Public exploit EPSS 22%

  Microsoft Streaming Service Elevation of Privilege Vulnerability

  Microsoft Streaming Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jun 13, 2023

  KEV Feb 29, 2024
• High 8.8
  CVE-2023-33538 Exploited Public exploit EPSS 42%

  TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabil…

  Jun 7, 2023

  KEV Jun 16, 2025
• High 8.8
  CVE-2023-3079 Exploited Public exploit EPSS 38%

  Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap cor…

  Google Chrome chromium qt5-qtwebengine Browsers Debian Alpine
  Jun 5, 2023

  KEV Jun 7, 2023
• High 8.6
  CVE-2023-32315 Exploited Public exploit EPSS 100%

  Openfire administration console authentication bypass

  Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to us…

  igniterealtime Openfire org.igniterealtime.openfire:xmppserver openfire Alpine Maven
  May 26, 2023

  KEV Aug 24, 2023
• High 7.8
  CVE-2023-29336 Exploited Public exploit EPSS 41%

  Win32k Elevation of Privilege Vulnerability

  Win32k Elevation of Privilege Vulnerability

  Microsoft Windows Server 2016 Windows Server 2016 (Server Core installation) Windows 10 Version 1607 Windows
  May 9, 2023

  KEV May 9, 2023
• High 7.2
  CVE-2023-24955 Exploited · Ransomware Public exploit EPSS 85%

  Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition
  May 9, 2023

  KEV Mar 26, 2024
• High 7.5
  CVE-2023-29552 Exploited EPSS 64%

  The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services…

  openslp-dfsg Ubuntu
  Apr 25, 2023

  KEV Nov 8, 2023
• High 8.9
  CVE-2023-27524 Exploited Public exploit EPSS 98%

  Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

  Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resour…

  Apache Software Foundation Apache Superset apache-superset PyPI
  Apr 24, 2023

  KEV Jan 8, 2024
• High 8.2
  CVE-2023-27351 Exploited · Ransomware EPSS 78%

  This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

  PaperCut NG
  Apr 20, 2023

  KEV Apr 20, 2026
• High 7.2
  CVE-2023-22894 Exploited Public exploit

  Strapi leaking sensitive user information by filtering on private fields

  Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the …

  @strapi/strapi npm
  Apr 19, 2023

  KEV Oct 8, 2026
• High 8.8
  CVE-2023-2033 Exploited Public exploit EPSS 41%

  Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap cor…

  Google Chrome chromium qt5-qtwebengine Browsers Debian Alpine
  Apr 14, 2023

  KEV Apr 17, 2023
• High 7.8
  CVE-2023-28252 Exploited · Ransomware Public exploit EPSS 49%

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Apr 11, 2023

  KEV Apr 11, 2023
• High 7.0
  CVE-2023-28229 Exploited Public exploit

  Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

  Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Apr 11, 2023

  KEV Oct 4, 2023
• High 8.8
  CVE-2023-28205 Exploited Public exploit EPSS 27%

  A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 …

  Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu
  Apr 10, 2023

  KEV Apr 10, 2023
• High 8.6
  CVE-2023-28206 Exploited Public exploit EPSS 23%

  An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5…

  Apple macOS iOS and iPadOS macOS iOS
  Apr 10, 2023

  KEV Apr 10, 2023
• High 8.6
  CVE-2022-43939 Exploited Public exploit EPSS 92%

  Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions

  Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

  Hitachi Vantara Pentaho Business Analytics Server
  Apr 3, 2023

  KEV Mar 3, 2025
• High 8.8
  CVE-2022-43769 Exploited Public exploit EPSS 98%

  Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

  Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

  Hitachi Vantara Pentaho Business Analytics Server
  Apr 3, 2023

  KEV Mar 3, 2025
• High 7.8
  CVE-2023-20963 Exploited Public exploit

  In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional…

  Android
  Mar 24, 2023

  KEV Apr 13, 2023
• High 8.6
  CVE-2023-26360 Exploited Public exploit EPSS 97%

  Adobe ColdFusion Improper Access Control Arbitrary code execution

  Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…

  Adobe ColdFusion
  Mar 23, 2023

  KEV Mar 15, 2023
• High 8.8
  CVE-2023-28434 Exploited Public exploit

  MinIO is vulnerable to privilege escalation on Linux/MacOS

  Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…

  minio minio github.com/minio/minio Go
  Mar 22, 2023

  KEV Sep 19, 2023
• High 7.5
  CVE-2023-28432 Exploited Public exploit EPSS 84%

  Minio Information Disclosure in Cluster Deployment

  Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, res…

  minio minio
  Mar 22, 2023

  KEV Apr 21, 2023
• High 7.8
  CVE-2023-0386 Exploited Public exploit

  A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 22, 2023

  KEV Jun 17, 2025
• High 8.8
  CVE-2023-1389 Exploited Public exploit EPSS 100%

  TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability …

  Mar 15, 2023

  KEV May 1, 2023
• High 7.5
  CVE-2023-27532 Exploited · Ransomware Public exploit EPSS 81%

  Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…

  Mar 10, 2023

  KEV Aug 22, 2023
• High 8.8
  CVE-2019-8720 Exploited

  A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lea…

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu Alpine
  Mar 6, 2023

  KEV May 23, 2022