Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,898
- Last 24h
- 2,036
- Critical, 7 days
- 357
- Known exploited
- 1,779
2,624 results · Clear filters · Feed
-
Medium 4.3CVE-2023-46447 Public exploit
The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted gluc…
-
Medium 5.3CVE-2024-0737 Public exploit
Xlightftpd Xlight FTP Server Login denial of service
A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The manipulation of the argument user leads to denial of service. The attack can be initiated remotely. Th…
-
Medium 5.3CVE-2024-0725 Public exploit
ProSSHD denial of service
A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public …
-
Medium 5.3CVE-2024-0723 Public exploit
freeSSHd denial of service
A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the pub…
-
Medium 5.3
Apache Tomcat: Leaking of unrelated request bodies in default error page
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade …
-
Medium 6.1CVE-2024-23659 Public exploit
SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bi…
-
Medium 6.1CVE-2023-48858 Public exploit
A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to injec…
-
Medium 6.5CVE-2024-22411 Public exploit
Cross site scripting in Action messages on Avo
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appear…
-
Medium 6.5
Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server
An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed…
-
Medium 5.3
EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
-
Medium 6.3CVE-2011-10005 Public exploit
EasyFTP MKD Command buffer overflow
A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has bee…
-
Medium 6.1CVE-2023-48104 Public exploit
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
-
Medium 6.5CVE-2023-47459 Public exploit
An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryRevie…
-
Medium 6.5
Apache Solr: Host environment variables are published via the Metrics API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide…
-
Medium 5.3CVE-2024-0546 Public exploit
EasyFTP LIST Command denial of service
A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exp…
-
Medium 5.4CVE-2023-50072 Public exploit
A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension…
-
Medium 4.3CVE-2023-40362 Public exploit
An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protecti…
-
Medium 5.5CVE-2023-42829 Public exploit
The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS B…
-
Medium 6.5
Windows Themes Spoofing Vulnerability
Windows Themes Spoofing Vulnerability
-
Medium 5.7CVE-2024-21306 Public exploit
Microsoft Bluetooth Driver Spoofing Vulnerability
Microsoft Bluetooth Driver Spoofing Vulnerability
-
Medium 4.4CVE-2024-21305 Public exploit
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
-
Medium 6.6CVE-2024-20666 Public exploit
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
Medium 5.3
WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.
-
Medium 5.3CVE-2022-2602 Public exploit
io_uring UAF, Unix SCM garbage collection
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
Medium 5.3
Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure
A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to in…
-
Medium 6.5CVE-2023-52271 Public exploit
The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process…
-
Medium 6.3
spider-flow FunctionController.java FunctionService.saveFunction code injection
A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It …
-
Medium 6.1CVE-2023-6000 Public exploit
Popup Builder < 4.2.3 - Unauthenticated Stored XSS
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
-
Medium 4.3CVE-2023-7173 Public exploit
PHPGurukul Hospital Management System registration.php cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible …
-
Medium 5.9CVE-2023-44088 Public exploit
SQL Injection in Visual Console
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora …
-
Medium 6.1CVE-2023-49438 Public exploit
Open redirect vulnerability in Flask-Security-Too
An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.
-
Medium 5.3CVE-2023-49792 Public exploit
Bruteforce protection can be bypassed with misconfigured proxy
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a…
-
Medium 4.3CVE-2023-6289 Public exploit
Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
-
Medium 6.5
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, an…
-
Medium 6.3
Hikvision Intercom Broadcasting System ping.php os command injection
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input …
-
Medium 6.2CVE-2023-45184 Public exploit
IBM i Access Client Solutions
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270.
-
Medium 5.4CVE-2023-6710 Public exploit
Mod_cluster/mod_proxy_cluster: stored cross site scripting
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter…