Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,840
- Last 24h
- 2,089
- Critical, 7 days
- 353
- Known exploited
- 1,779
2,624 results · Clear filters · Feed
-
Medium 6.8CVE-2024-50404 Public exploit
Qsync Central
A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in …
-
Medium 6.4CVE-2024-11201 Public exploit
myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin…
-
Medium 6.1CVE-2024-50677 Public exploit
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or…
-
Medium 5.5CVE-2024-12227 Public exploit
MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereference
A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library NTIOLib_X64.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. I…
-
Medium 4.3CVE-2024-54679 Public exploit
CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.
-
Medium 6.5CVE-2024-53259 Public exploit
quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-…
-
Medium 4.8CVE-2024-53617 Public exploit
A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via up…
-
Medium 6.1CVE-2024-11252 Public exploit
Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escapin…
-
Medium 5.3CVE-2024-53255 Public exploit
Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the …
-
Medium 6.9CVE-2024-50395 Public exploit
Media Streaming add-on
An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege. We have already fixed the vulnerability in the followi…
-
Medium 6.8CVE-2024-50657 Public exploit
An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCode…
-
Medium 6.9
Command Injection leading to RCE via LDAP Misconfiguration
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4
-
Medium 6.1CVE-2024-50803 Public exploit
Redaxo Core CMS Cross Site Scripting (XSS)
The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges
-
Medium 5.7CVE-2024-52711 Public exploit
DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.
-
Medium 5.9
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this…
KEV Nov 18, 2024 -
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or…
KEV Nov 18, 2024 -
Medium 6.1CVE-2024-52318 Public exploit
Apache Tomcat: Incorrect JSP tag recycling leads to XSS
Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
-
Medium 6.5CVE-2024-52317 Public exploit
Apache Tomcat: Request/response mix-up with HTTP/2
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 throug…
-
Medium 5.3CVE-2024-38828 Public exploit
CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
-
Medium 6.5CVE-2024-50848 Public exploit
An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldS…
-
Medium 4.8CVE-2024-50849 Public exploit
A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote a…
-
Medium 6.1CVE-2024-33231 Public exploit
Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a …
-
Medium 4.2CVE-2024-52510 Public exploit
Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It i…
-
Medium 5.3CVE-2024-24450 Public exploit
Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface C…
-
Medium 5.3CVE-2024-7124 Public exploit
Reflected XSS in DInGO dLibra
Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL…
-
Medium 5.1CVE-2024-5083 Public exploit
Nexus Repository 2 - Stored XSS
A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
-
Medium 5.3CVE-2024-49379 Public exploit
Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel
Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vuln…
-
Medium 6.1CVE-2024-50969 Public exploit
A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote att…
-
Medium 6.5CVE-2024-50970 Public exploit
A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote att…
-
Medium 6.5CVE-2024-50971 Public exploit
A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers t…
-
Medium 6.5CVE-2024-50972 Public exploit
A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attacke…
-
Medium 4.3CVE-2024-40443 Public exploit
SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker t…
-
Medium 6.1CVE-2024-42834 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SA…
-
Medium 5.1
Limited remote code execution with privilege of a NetworkService Account access
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
KEV Aug 25, 2025 -
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
KEV Nov 12, 2024 -
Medium 5.1
Privilege escalation to NetworkService Account access
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
KEV Aug 25, 2025 -
Medium 5.4CVE-2024-51026 Public exploit
The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx end…
-
Medium 6.5CVE-2024-44765 Public exploit
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.…
-
Medium 5.4CVE-2024-51032 Public exploit
A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 all…
-
Medium 6.5CVE-2024-51030 Public exploit
A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows …