Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,940
- Last 24h
- 2,064
- Critical, 7 days
- 353
- Known exploited
- 1,779
2,624 results · Clear filters · Feed
-
Medium 6.1CVE-2022-41441 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts …
-
Medium 5.9CVE-2022-43704 Public exploit
The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirem…
-
Medium 4.9CVE-2022-43959 Public exploit
Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remo…
-
Medium 6.5CVE-2022-31901 Public exploit
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the appl…
-
Medium 6.1CVE-2023-0214 Public exploit
XSS in Skyhigh Security SWG
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party we…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affecte…
-
Medium 6.1CVE-2022-39195 Public exploit
A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary…
-
Medium 6.1CVE-2022-3904 Public exploit
MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
-
Medium 4.6CVE-2018-25075 Public exploit
karsany OBridge ProcedureDao.java getAllStandaloneProcedureAndFunction sql injection
A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection…
-
Medium 6.1CVE-2022-46622 Public exploit
A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web …
-
Medium 6.1CVE-2022-45729 Public exploit
A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute a…
-
Medium 6.1CVE-2022-45728 Public exploit
Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
-
Medium 5.4CVE-2022-47102 Public exploit
A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute …
-
Medium 5.5CVE-2022-4543 Public exploit
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local att…
-
Medium 4.7CVE-2023-21766 Public exploit
Windows Overlay Filter Information Disclosure Vulnerability
Windows Overlay Filter Information Disclosure Vulnerability
-
Medium 6.8CVE-2023-21563 Public exploit
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
Medium 6.6CVE-2023-21560 Public exploit
Windows Boot Manager Security Feature Bypass Vulnerability
Windows Boot Manager Security Feature Bypass Vulnerability
-
Medium 5.5CVE-2015-10034 Public exploit
j-nowak workout-organizer sql injection
A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 13cd6c3d1210640bfdb39872b2bb3597aa991279. It is recommended to…
-
Medium 6.1CVE-2022-44870 Public exploit
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary …
-
Medium 5.3CVE-2023-22622 Public exploit
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting securit…
-
Medium 5.5CVE-2022-34683 Public exploit
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Medium 6.1CVE-2022-30519 Public exploit
XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary …
-
Medium 4.6CVE-2021-4281 Public exploit
Brave UX for-the-badge combine-prs.yml os command injection
A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a2…
-
Medium 6.1CVE-2022-36664 Public exploit
Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultUR…
-
Medium 5.3CVE-2019-19030 Public exploit
Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
-
Medium 5.3
Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. …
-
Medium 5.4CVE-2022-43271 Public exploit
Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerabil…
-
Medium 5.4CVE-2021-43657 Public exploit
A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (S…
-
Medium 4.3CVE-2022-4611 Public exploit
Click Studios Passwordstate hard-coded credentials
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack re…
-
Medium 5.9CVE-2022-3590 Public exploit
WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
-
Medium 6.1CVE-2022-46381 Public exploit
Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_templa…
-
Medium 5.4CVE-2022-25630 Public exploit
An authenticated user can embed malicious content with XSS into the admin group policy page.
-
Medium 5.3CVE-2022-41717 Public exploit
Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…
-
Medium 6.5CVE-2022-38599 Public exploit
Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /use…
-
Medium 5.4CVE-2022-45217 Public exploit
A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary…
-
Medium 6.1CVE-2022-43369 Public exploit
AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the comp…
-
Medium 5.4CVE-2022-43097 Public exploit
Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripti…
-
Medium 4.3CVE-2022-41413 Public exploit
perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attac…
-
Medium 6.1CVE-2022-36433 Public exploit
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript …
-
Medium 4.3CVE-2020-23588 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…