Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 408,941
Last 24h: 1,997
Critical, 7 days: 352
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

2,624 results · Clear filters · Feed

Medium 6.8

CVE-2022-0020 Public exploit

Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface

A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on…

Palo Alto Networks Cortex XSOAR Network devices

Feb 10, 2022
Medium —

CVE-2022-22931 Public exploit

Path traversal in Apache James 3.6.1

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by …

Apache Software Foundation Apache James org.apache.james:james-server Maven

Feb 7, 2022
Medium 5.8

CVE-2021-4043 Public exploit

NULL Pointer Dereference in gpac/gpac

NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.

gpac gpac/gpac gpac Debian

Feb 4, 2022
Medium 6.1

CVE-2022-22818 Public exploit

Cross-site Scripting in Django

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

python-django django python-django py3-django Debian Ubuntu Alpine PyPI

Feb 3, 2022
Medium 6.1

CVE-2021-43062 Public exploit EPSS 13%

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.…

Fortinet Fortinet FortiMail Network devices

Feb 2, 2022
Medium —

CVE-2021-45416 Public exploit

RosarioSIS XSS Vulnerability

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

francoisjacquet/rosariosis Packagist

Feb 1, 2022
Medium 5.3

CVE-2022-22932 Public exploit

Path traversal flaws

Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: htt…

Apache Software Foundation Apache Karaf org.apache.karaf:apache-karaf Maven

Jan 26, 2022
Medium 6.6

CVE-2021-22600 Exploited Public exploit

Double Free in net/packet/af_packet.c leading to priviledge escalation

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…

Linux kernel kernel linux-raspi2 linux-hwe Debian Ubuntu

Jan 26, 2022
KEV Apr 11, 2022
Medium 6.1

CVE-2022-23808 Public exploit

Cross-site Scripting in phpmyadmin

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.

phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist

Jan 22, 2022
Medium 5.5

CVE-2022-0219 Public exploit

Improper Restriction of XML External Entity Reference in skylot/jadx

Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

skylot skylot/jadx io.github.skylot:jadx-core Maven

Jan 20, 2022
Medium 5.5

CVE-2021-34600 Public exploit

Telenot complex: Insecure AES Key Generation

Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.

Telenot Electronic CompasX

Jan 20, 2022
Medium 6.5

CVE-2022-21350 Public exploit

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

Oracle WebLogic Server

Jan 19, 2022
Medium 5.3

CVE-2022-21340 Public exploit

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…

Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine

Jan 19, 2022
Medium 6.1

CVE-2021-44217 Public exploit

Cross-site Scripting in Ericsson CodeChecker

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.

codechecker codechecker-api PyPI

Jan 18, 2022
Medium 5.5

CVE-2021-45067 Public exploit

Adobe Acrobat Reader Memory Corruption could lead to Information Disclosure

Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to disclosure of sensitive memory. An attacker could…

Adobe Acrobat Reader

Jan 14, 2022
Medium 6.1

CVE-2022-21970 Public exploit

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 11, 2022
Medium 4.4

CVE-2022-21894 Public exploit

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 5.5

CVE-2022-21877 Public exploit

Storage Spaces Controller Information Disclosure Vulnerability

Storage Spaces Controller Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.1

CVE-2022-21839 Public exploit

Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability

Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.6

CVE-2021-44832 Public exploit EPSS 98%

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…

Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Dec 28, 2021
Medium 6.8

CVE-2021-45511 Public exploit EPSS 19%

Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 202…

Dec 26, 2021
Medium 5.9

CVE-2021-45105 Public exploit EPSS 100%

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…

Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Dec 18, 2021
Medium 4.3

CVE-2021-43908 Public exploit

Visual Studio Code Spoofing Vulnerability

Visual Studio Code Spoofing Vulnerability

Microsoft Visual Studio Code

Dec 15, 2021
Medium 5.5

CVE-2021-43224 Public exploit

Windows Common Log File System Driver Information Disclosure Vulnerability

Windows Common Log File System Driver Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 15, 2021
Medium 6.1

CVE-2021-40154 Public exploit

NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration re…

Dec 1, 2021
Medium 5.3

CVE-2021-21707 Public exploit EPSS 25%

Special characters break path parsing in XML functions

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function …

PHP Group PHP php5 php7.0 Debian Ubuntu Alpine

Nov 29, 2021
Medium 6.5

CVE-2021-43408 Public exploit

Duplicate Post WordPress Plugin SQL Injection Vulnerability

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read,…

Copy Delete Posts Duplicate Post WordPress Plugin Web / CMS

Nov 19, 2021
Medium 5.4

CVE-2021-41278 Public exploit

Broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectors

Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk “AES” transform in EdgeX …

edgexfoundry app-functions-sdk-go github.com/edgexfoundry/app-functions-sdk-go github.com/edgexfoundry/app-functions-sdk-go/v2 Go

Nov 18, 2021
Medium 5.7

CVE-2021-3572 Public exploit

Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This i…

python-pip pip python-pip Debian Ubuntu PyPI

Nov 10, 2021
Medium 4.3

CVE-2021-41351 Public exploit

Microsoft Edge (Chrome based) Spoofing on IE Mode

Microsoft Edge (Chrome based) Spoofing on IE Mode

Microsoft Microsoft Edge (Chromium-based) in IE Mode Browsers

Nov 10, 2021
Medium 6.5

CVE-2021-41349 Public exploit EPSS 93%

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2016 Cumulative Update 22

Nov 10, 2021
Medium 5.3

CVE-2021-31602 Public exploit EPSS 52%

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. Th…

Nov 8, 2021
Medium 5.9

CVE-2021-36808 Public exploit

A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before ver…

Sophos Sophos Secure Workspace for Android Android Network devices

Oct 30, 2021
Medium 6.5

CVE-2021-41184 Public exploit EPSS 41%

XSS in the `of` option of the `.position()` util

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…

jquery jquery-ui jquery-ui jquery-ui-rails Debian Ubuntu npm Maven NuGet RubyGems

Oct 26, 2021
Medium 6.5

CVE-2021-41182 Public exploit EPSS 39%

XSS in the `altField` option of the Datepicker widget

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value…

jquery jquery-ui drupal7 jQuery.UI.Combined Debian Ubuntu Alpine npm Maven NuGet RubyGems

Oct 26, 2021
Medium 5.3

CVE-2021-41160 Public exploit

Improper region checks in FreeRDP allow out of bound write to memory

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphic…

FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

Oct 21, 2021
Medium 5.4

CVE-2021-35616 Public exploit EPSS 28%

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). Th…

Oracle Transportation Management

Oct 20, 2021
Medium 5.9

CVE-2021-2471 Public exploit

Incorrect Authorization in MySQL Connector Java

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to…

Oracle MySQL Connectors percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Maven

Oct 20, 2021
Medium 5.5

CVE-2021-41338 Public exploit

Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability

Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 13, 2021
Medium 6.1

CVE-2021-42053 Public exploit

Cross-site scripting in Unicorn framework

The Unicorn framework through 0.35.3 for Django allows XSS via component.name.

django-unicorn PyPI

Oct 7, 2021