Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,414
- Last 24h
- 637
- Critical, 7 days
- 336
- Known exploited
- 1,779
97,632 results · Clear filters · Feed
-
High 8.3
Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised t…
-
High 7.4
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outsid…
-
High 8.8
Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary c…
-
High 7.4
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outsid…
-
High 7.4
Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory …
-
High 8.3
Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised …
-
High 8.3
Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…
-
High 8.8
Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass we…
-
High 8.8
Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass …
-
High 8.8
Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code …
-
High 8.8
Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3…
-
High 8.1
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier…
-
High 7.5
Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allow…
-
High 7.8
Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticate…
-
High 8.1
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an…
-
High 7.8CVE-2026-115878 Public exploit
Stanza: RCE via pickle deserialization in the lemmatizer
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trai…
-
High 7.1
MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write
An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target th…
-
High 7.3
mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The …
-
High 7.7
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sand…
-
High 7.5
Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable
Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed…
-
High 7.1
Local Privilege Escalation in Virtual Intranet Access (VIA) Client for Linux
An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system.
-
High 7.2
Authenticated Command Injection Vulnerability in HPE Networking VIA
A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on the underlying operating system.
-
High 7.8
Authenticated Local Command Injection Vulnerability in the VIA Client for Linux
A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.
-
High 7.5
Unauthenticated Buffer Overflow Vulnerability Leading to Denial-of-Service in HPE Networking VIA
A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client.
-
High 8.1
Unauthenticated Improper Certificate Validation leads to Authentication Bypass in HPE Networking Virtual Intranet Access (VIA)
An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms, leading to the possible disclosure of sensitiv…
-
High 8.4
Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in Virtual Intranet Access (VIA) Client
A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a low-privileged local attacker to execute arbitrary code with elevated privileges on the…
-
High 8.8
Local Privilege Escalation Vulnerability in the Virtual Intranet Access (VIA) Client
A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges o…
-
High 8.1CVE-2026-54161 Public exploit
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed…
-
High 7.2
Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field c…
-
High 7.1
Privilege Escalation in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.
-
High 7.1
Local Privilege Escalation in HPE Networking Fabric Composer
A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.
-
High 7.4
Unauthenticated Improper Certificate Validation Leads to Authentication Bypass in HPE Networking Fabric Composer
An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Suc…
-
High 7.5
Unauthenticated Improper Certificate Validation in HPE Networking Fabric Composer
An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could…
-
High 7.5
Unauthenticated Missing Integrity Verification in HPE Networking Fabric Composer
A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
-
High 7.5
Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer
A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.
-
High 7.5
Privilege Escalation in the SSH Interface of HPE Networking Fabric Composer
A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's contro…
-
High 7.5
Authentication Bypass in the API Endpoint of HPE Networking Fabric Composer
An authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Su…
-
High 7.5
Unauthenticated Remote Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric Composer
A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable.
-
High 7.7
Authenticated Adjacent Sensitive Information Disclosure in HPE Networking Fabric Composer
A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are m…
-
High 7.8
Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer
Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.