Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 409,241
Last 24h: 581
Critical, 7 days: 356
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

931 results · Clear filters · Feed

High 8.8

CVE-2023-23529 Exploited

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.…

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Feb 27, 2023
KEV Feb 14, 2023
High 7.8

CVE-2023-21823 Exploited Public exploit

Windows Graphics Component Remote Code Execution Vulnerability

Windows Graphics Component Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows Android iOS

Feb 14, 2023
KEV Feb 14, 2023
High 7.8

CVE-2023-23376 Exploited · Ransomware EPSS 11%

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Feb 14, 2023
KEV Feb 14, 2023
High 7.3

CVE-2023-21715 Exploited EPSS 12%

Microsoft Publisher Security Feature Bypass Vulnerability

Microsoft Publisher Security Feature Bypass Vulnerability

Microsoft Microsoft 365 Apps for Enterprise

Feb 14, 2023
KEV Feb 14, 2023
High 8.8

CVE-2023-21529 Exploited · Ransomware EPSS 59%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Feb 14, 2023
KEV Apr 13, 2026
High 7.2

CVE-2023-0669 Exploited · Ransomware Public exploit EPSS 100%

Fortra GoAnywhere MFT License Response Servlet Command Injection

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Fortra GoAnywhere MFT

Feb 6, 2023
KEV Feb 10, 2023
High 7.9

CVE-2023-0266 Exploited Public exploit

Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …

Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Jan 30, 2023
KEV Mar 30, 2023
High 7.8

CVE-2023-21608 Exploited Public exploit EPSS 59%

Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…

Adobe Acrobat Reader

Jan 18, 2023
KEV Oct 10, 2023
High 7.5

CVE-2023-21839 Exploited Public exploit EPSS 100%

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

Oracle WebLogic Server

Jan 17, 2023
KEV May 1, 2023
High 8.8

CVE-2023-22952 Exploited Public exploit EPSS 80%

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because …

Jan 11, 2023
KEV Feb 2, 2023
High 8.8

CVE-2023-21674 Exploited Public exploit EPSS 34%

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 10, 2023
KEV Jan 10, 2023
High 8.8

CVE-2022-26485 Exploited Public exploit EPSS 14%

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022
KEV Mar 7, 2022
High 8.8

CVE-2022-42856 Exploited

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS…

Apple tvOS qtwebkit-source qtwebkit-opensource-src Debian Ubuntu

Dec 15, 2022
KEV Dec 14, 2022
High 8.8

CVE-2022-4262 Exploited Public exploit EPSS 24%

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Dec 2, 2022
KEV Dec 5, 2022
High 8.8

CVE-2022-40799 Exploited EPSS 34%

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS …

Nov 29, 2022
KEV Aug 5, 2025
High 7.8

CVE-2022-23748 Exploited

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from wh…

Windows

Nov 17, 2022
KEV Feb 6, 2025
High 7.8

CVE-2022-41073 Exploited · Ransomware

Windows Print Spooler Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 9, 2022
KEV Nov 8, 2022
High 7.8

CVE-2022-41125 Exploited

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 9, 2022
KEV Nov 8, 2022
High 8.8

CVE-2022-41128 Exploited EPSS 25%

Windows Scripting Languages Remote Code Execution Vulnerability

Windows Scripting Languages Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2022 Windows

Nov 9, 2022
KEV Nov 8, 2022
High 8.8

CVE-2022-41080 Exploited · Ransomware Public exploit EPSS 77%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Nov 9, 2022
KEV Jan 10, 2023
High 8.8

CVE-2022-3723 Exploited

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corr…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 1, 2022
KEV Oct 28, 2022
High 7.8

CVE-2022-42827 Exploited

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS …

Apple iOS and iPadOS iOS

Nov 1, 2022
KEV Oct 25, 2022
High 8.8

CVE-2022-38181 Exploited Public exploit EPSS 18%

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…

Oct 25, 2022
KEV Mar 30, 2023
High 7.8

CVE-2022-38028 Exploited EPSS 15%

Windows Print Spooler Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 11, 2022
KEV Apr 23, 2024
High 7.8

CVE-2022-41033 Exploited

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 11, 2022
KEV Oct 11, 2022
High 8.8

CVE-2022-41040 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Oct 3, 2022
KEV Sep 30, 2022
High 8.0

CVE-2022-41082 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12

Oct 3, 2022
KEV Sep 30, 2022
High 7.8

CVE-2022-20775 Exploited EPSS 12%

Cisco SD-WAN Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerab…

Cisco Cisco Catalyst SD-WAN Manager Cisco SD-WAN vEdge Router Cisco SD-WAN vEdge Cloud Network devices

Sep 30, 2022
KEV Feb 25, 2026
High 8.8

CVE-2022-3038 Exploited EPSS 25%

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially expl…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Sep 26, 2022
KEV Mar 30, 2023
High 7.8

CVE-2022-32917 Exploited

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15…

Apple macOS iOS macOS iOS

Sep 20, 2022
KEV Sep 14, 2022
High 7.2

CVE-2022-40139 Exploited

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One …

Trend Micro Trend Micro Apex One

Sep 19, 2022
KEV Sep 15, 2022
High 7.8

CVE-2022-37969 Exploited · Ransomware Public exploit EPSS 28%

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Sep 13, 2022
KEV Sep 14, 2022
High 7.5

CVE-2022-36537 Exploited · Ransomware Public exploit EPSS 95%

ZK Framework vulnerable to malicious POST

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

org.zkoss.zk:zk Maven

Aug 26, 2022
KEV Feb 27, 2023
High 8.8

CVE-2022-36804 Exploited Public exploit EPSS 99%

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…

Atlassian Bitbucket Server Bitbucket Data Center

Aug 25, 2022
KEV Sep 30, 2022
High 8.8

CVE-2022-32893 Exploited EPSS 10%

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Aug 24, 2022
KEV Aug 18, 2022
High 7.8

CVE-2022-32894 Exploited

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …

Apple macOS iOS and iPadOS macOS iOS

Aug 24, 2022
KEV Aug 18, 2022
High 8.6

CVE-2022-0028 Exploited

PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering

A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (vi…

Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices

Aug 10, 2022
KEV Aug 22, 2022
High 7.8

CVE-2022-34713 Exploited EPSS 68%

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Aug 9, 2022
KEV Aug 9, 2022
High 8.8

CVE-2022-2294 Exploited · Ransomware EPSS 71%

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploi…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jul 28, 2022
KEV Aug 25, 2022
High 8.8

CVE-2022-1364 Exploited Public exploit EPSS 14%

Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jul 26, 2022
KEV Apr 15, 2022

Latest vulnerabilities

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.…

Windows Graphics Component Remote Code Execution Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Publisher Security Feature Bypass Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Fortra GoAnywhere MFT License Response Servlet Command Injection

Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because …

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS…

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS …

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from wh…

Windows Print Spooler Elevation of Privilege Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Windows Scripting Languages Remote Code Execution Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corr…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS …

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…

Windows Print Spooler Elevation of Privilege Vulnerability

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Cisco SD-WAN Software Privilege Escalation Vulnerability

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially expl…

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15…

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One …

Windows Common Log File System Driver Elevation of Privilege Vulnerability

ZK Framework vulnerable to malicious POST

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …

PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploi…

Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit…