Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,413
- Last 24h
- 697
- Critical, 7 days
- 339
- Known exploited
- 1,779
12,723 results · Clear filters · Feed
-
Low 3.3
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
Low 3.7
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address…
-
Low 3.7
WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer'…
-
Low 2.1
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive informatio…
-
Low 3.1
Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had comp…
-
Low 3.1
Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Low 3.1
Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had comp…
-
Low 3.1
Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-ori…
-
Low 3.1
Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the re…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had c…
-
Low 3.1
Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromise…
-
Low 3.1
Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised t…
-
Low 3.1
Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the …
-
Low 3.4
Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised t…
-
Low 3.1
Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromis…
-
Low 3.1
Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Low 3.1
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer…
-
Low 3.1
Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised th…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Low 3.1
Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social …
-
Low 2.7
Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read…
-
Low 3.5
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailb…
-
Low 3.1
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. …
-
Low 3.5
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated …
-
Low 3.3
Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler
A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
-
Low 3.5
Adobe Experience Manager | Improper Input Validation (CWE-20)
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write acce…
-
Low 3.3
In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could le…
-
Low 3.5
In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect b…
-
Low 3.3
In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead…
-
Low 3.3
In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This c…
-
Low 3.3
In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a con…
-
Low 3.3
In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This cou…
-
Low 3.3
In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could l…
-
Low 3.1
In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This coul…
-
Low 3.3
In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the…
-
Low 3.3
In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This co…
-
Low 3.3
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to…
-
Low 3.3
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permis…
-
Low 3.3
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of dev…