Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,811
- Last 24h
- 2,096
- Critical, 7 days
- 348
- Known exploited
- 1,779
82 results · Clear filters · Feed
-
Medium 6.1
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…
KEV Mar 30, 2023 -
Medium 6.8
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary…
KEV Mar 7, 2023 -
Medium 6.5
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…
KEV Jul 17, 2024 -
Medium 6.6
Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…
KEV Apr 11, 2022 -
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …
KEV Nov 3, 2021 -
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path t…
KEV Nov 12, 2024 -
Medium 5.3
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…
KEV Mar 28, 2022 -
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
KEV Nov 3, 2021 -
Medium 6.6
Microsoft Exchange Server Security Feature Bypass Vulnerability
Microsoft Exchange Server Security Feature Bypass Vulnerability
KEV Nov 3, 2021 -
Medium 6.8
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…
KEV Nov 17, 2021 -
Medium 4.4
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…
KEV Nov 8, 2022 -
Medium 5.3
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…
KEV Mar 7, 2022 -
Medium 6.1
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attac…
KEV Jun 22, 2023 -
Medium 5.5
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watc…
KEV Nov 3, 2021 -
Medium 6.1
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against …
KEV Nov 3, 2021 -
Medium 5.5
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…
KEV Sep 8, 2022 -
Medium 5.5
Netlogon Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could ru…
KEV Nov 3, 2021 -
Medium 6.5
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …
KEV Nov 3, 2021 -
Medium 6.5
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024 -
Medium 6.5
SaltStack Salt is vulnerable Arbitrary Directory Access
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
KEV Nov 3, 2021 -
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Medium 6.5
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the…
KEV Oct 24, 2022 -
Medium 6.5
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…
KEV Jun 8, 2022 -
Medium 6.5
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attack…
KEV Jun 25, 2025 -
Medium 6.5
Use-After-Free in puppeteer
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
KEV May 23, 2022 -
Medium 6.1
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_opti…
KEV Nov 3, 2021 -
Medium 4.3
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 a…
KEV Sep 8, 2022 -
Medium 6.6
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information p…
KEV Nov 3, 2021 -
Medium 4.3
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via…
KEV Mar 28, 2022 -
Medium 5.5
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
KEV May 24, 2022 -
Medium 5.5
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…
KEV Nov 3, 2021 -
Medium 5.5
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct…
KEV Nov 3, 2021 -
Medium 5.3
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user info…
KEV Jun 9, 2022 -
Medium 6.6
Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1…
KEV May 25, 2022 -
Medium 5.5
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver …
KEV May 12, 2023 -
Medium 6.5
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the exis…
KEV May 25, 2022 -
Medium 5.5
WinVerifyTrust Signature Validation Vulnerability
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Wind…
KEV Jan 10, 2022 -
Medium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated us…
KEV Mar 25, 2022 -
Medium 5.5
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, w…
KEV May 25, 2022