Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,940
- Last 24h
- 2,039
- Critical, 7 days
- 353
- Known exploited
- 1,779
2,624 results · Clear filters · Feed
-
Medium 4.3CVE-2020-23586 Public exploit
A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an una…
-
Medium 6.5CVE-2020-23589 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Medium 6.5CVE-2020-23593 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenti…
-
Medium 6.5CVE-2020-23590 Public exploit
A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Medium 5.4CVE-2022-35501 Public exploit
Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the d…
-
Medium 5.4CVE-2022-35500 Public exploit
Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
-
Medium 5.4CVE-2022-45472 Public exploit
CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onp…
-
Medium 5.4CVE-2022-41446 Public exploit
An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to …
-
Medium 4.8CVE-2022-42095 Public exploit
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
-
Medium 4.8CVE-2022-41445 Public exploit
A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execut…
-
Medium 4.8CVE-2022-42097 Public exploit
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
-
Medium 4.8CVE-2022-42094 Public exploit
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
-
Medium 6.5CVE-2020-23582 Public exploit
A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, …
-
Medium 4.8CVE-2022-40470 Public exploit
Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.
-
Medium 4.8CVE-2022-42096 Public exploit
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
-
Medium 5.4CVE-2022-43117 Public exploit
Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scri…
-
Medium 5.5CVE-2022-4065 Public exploit
cbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversal
A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML F…
-
Medium 5.4CVE-2022-36432 Public exploit
The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers …
-
Medium 6.8CVE-2022-43096 Public exploit
Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.
-
Medium 6.1CVE-2022-43332 Public exploit
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTM…
-
Medium 6.5CVE-2022-31630 Public exploit
OOB read due to insufficient input validation in imageloadfont()
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…
-
Medium 4.3CVE-2022-3942 Public exploit
SourceCodester Sanitization Management System cross site scripting
A vulnerability was found in SourceCodester Sanitization Management System and classified as problematic. This issue affects some unknown processing of the file php-sms/?p=request_quote. The manipulation leads to cross site scripting. The attack may be initia…
-
Medium 6.5CVE-2022-38121 Public exploit
POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials
UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configuration file.
-
Medium 6.5CVE-2022-38120 Public exploit
POWERCOM CO., LTD. UPSMON PRO - Path Traversal
UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and access arbitrary system files.
-
Medium 4.6CVE-2022-41099 Public exploit
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
Medium 5.5CVE-2022-44318 Public exploit
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c w…
-
Medium 5.5CVE-2022-44312 Public exploit
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in express…
-
Medium 5.4CVE-2022-43144 Public exploit
A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web …
-
Medium 5.4CVE-2021-40303 Public exploit
perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.
-
Medium 4.7CVE-2021-42205 Public exploit
ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows loc…
-
Medium 5.4CVE-2021-39473 Public exploit
Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and cont…
-
Medium 6.5CVE-2022-34662 Public exploit
Apache DolphinScheduler prior to 3.0.0 allows path traversal
When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher
-
Medium 5.5CVE-2022-32862 Public exploit
This issue was addressed with improved data protection. This issue is fixed in macOS Big Sur 11.7.1, macOS Ventura 13, …
-
Medium 6.5CVE-2022-26884 Public exploit
Apache DolphinScheduler exposes files without authentication
Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
-
Medium 6.8
gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vuln…
-
Medium 5.4CVE-2022-41358 Public exploit
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrar…
-
Medium 5.5CVE-2022-39253 Public exploit
Git subject to exposure of sensitive information via local clone of symbolic links
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (wh…
-
Medium 5.9CVE-2022-41540 Public exploit
The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. A…
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Medium 4.3CVE-2022-3464 Public exploit
puppyCMS settings.php cross site scripting
A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remot…