Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,861
- Last 24h
- 2,105
- Critical, 7 days
- 356
- Known exploited
- 1,779
2,624 results · Clear filters · Feed
-
Medium 4.3CVE-2024-4875 Public exploit
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'ajax_dismiss' function in versions up to, and including, 2.5.2. This makes it possible f…
-
Medium 6.3CVE-2024-36039 Public exploit
PyMySQL SQL Injection vulnerability
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
-
Medium 6.5CVE-2024-33901 Public exploit
Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in …
-
Medium 6.3CVE-2024-31974 Public exploit
The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote…
-
Medium 4.8CVE-2024-34241 Public exploit
A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript p…
-
Medium 5.3CVE-2023-46197 Public exploit
WordPress Popup by Supsystic plugin <= 1.10.19 - Unauthenticated Subscriber Email Addresses Disclosure
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: from n/a through 1.10.19.
-
Medium 5.3CVE-2024-35176 Public exploit
REXML contains a denial of service vulnerability
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.…
-
Medium 6.5CVE-2024-34958 Public exploit
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi…
-
Medium 6.1CVE-2024-34582 Public exploit
Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Pass…
-
Medium 5.6
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
Medium 5.4CVE-2023-24203 Public exploit
Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacke…
-
Medium 6.1CVE-2024-34225 Public exploit
Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PH…
-
Medium 5.9CVE-2024-34222 Public exploit
Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the searccountry parameter.
-
Medium 4.3CVE-2024-34223 Public exploit
Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow…
-
Medium 6.5CVE-2023-43040 Public exploit
IBM Spectrum Fusion HCI improper access control
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
-
Medium 6.7CVE-2024-27460 Public exploit
A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.
-
Medium 5.4CVE-2024-4232 Public exploit
Password Storage in Plaintext Vulnerability in Digisol Router
This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this…
-
Medium 6.8CVE-2024-4231 Public exploit
Incorrect Access Control Vulnerability in Digisol Router
This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by iden…
-
Medium 6.1CVE-2024-4041 Public exploit
Yoast SEO <= 22.5 - Reflected Cross-Site Scripting
The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject a…
-
Medium 6.4CVE-2024-24787 Public exploit
Arbitrary code execution during build on Darwin in cmd/go
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
-
Medium 5.9CVE-2024-34568 Public exploit
WordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects LetterPress: from n/a through 1.2.1.
-
Medium 6.5CVE-2024-23709 Public exploit
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote…
-
Medium 4.3CVE-2024-32369 Public exploit
SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to o…
-
Medium 5.4CVE-2024-34064 Public exploit
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…
-
Medium 5.5CVE-2024-34472 Public exploit
An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerabil…
-
Medium 5.4CVE-2024-34471 Public exploit
An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exis…
-
Medium 5.4CVE-2024-33111 Public exploit
D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php.
-
Medium 5.3CVE-2024-33113 Public exploit
D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.
-
Medium 6.5CVE-2024-30851 Public exploit
Directory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive info…
-
Medium 5.3CVE-2024-0710 Public exploit
GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID Modification
The GP Unique ID plugin for WordPress is vulnerable to Unique ID Modification in all versions up to, and including, 1.5.5. This is due to insufficient input validation. This makes it possible for unauthenticated attackers to tamper with the generation of a un…
-
Medium 6.5CVE-2024-3553 Public exploit
Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for…
-
Medium 6.6CVE-2024-23772 Public exploit
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file create vulnerability e…
-
Medium 6.5CVE-2024-33648 Public exploit
WordPress Recencio Book Reviews plugin <= 1.66.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemory Grubb Recencio Book Reviews recencio-book-reviews allows DOM-Based XSS.This issue affects Recencio Book Reviews: from n/a through <= 1.66.0.
-
Medium 6.1CVE-2024-23995 Public exploit
Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in …
-
Medium 4.0CVE-2024-33883 Public exploit
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
-
Medium 6.5CVE-2024-32868 Public exploit
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password ch…
-
Medium 6.5CVE-2023-47504 Public exploit
WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability
Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elementor Website Builder: from n/a through 3.16.4.
-
Medium 6.7CVE-2024-31804 Public exploit
An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privil…
-
Medium 5.9CVE-2024-1065 Public exploit
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to alr…