Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,612
- Last 24h
- 513
- Critical, 7 days
- 343
- Known exploited
- 1,779
97,795 results · Clear filters · Feed
-
High 7.5
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature check…
-
High 7.5
Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lo…
-
High 7.4
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while …
-
High 8.8
Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI eleme…
-
High 8.8
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social…
-
High 8.8
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive…
-
High 8.8
Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code…
-
High 8.8
UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof…
-
High 8.8
Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof …
-
High 8.8
Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origi…
-
High 8.8
Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system acc…
-
High 8.8
Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromi…
-
High 8.8
Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origi…
-
High 8.8
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI element…
-
High 8.8
Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social en…
-
High 8.8
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social e…
-
High 8.8
Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who ha…
-
High 8.8
UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social …
-
High 8.8
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
High 8.8
Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social …
-
High 8.8
Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak c…
-
High 8.8
Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineer…
-
High 8.8
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social…
-
High 8.8
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social…
-
High 8.8
Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social …
-
High 8.8
Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker…
-
High 8.8
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the …
-
High 8.8
Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had …
-
High 8.8
Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineerin…
-
High 8.8
Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive informa…
-
High 8.8
Information leak in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging s…
-
High 8.8
Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging so…
-
High 8.8
Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin …
-
High 8.8
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social…
-
High 8.8
Improper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social e…
-
High 8.8
Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromis…
-
High 8.8
UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging s…
-
High 8.8
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitr…
-
High 8.8
Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging …
-
High 8.8
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spo…