Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,811
- Last 24h
- 2,085
- Critical, 7 days
- 348
- Known exploited
- 1,779
214 results · Clear filters · Feed
-
Medium 5.3CVE-2025-35939 Exploited
Craft CMS stores user-provided content in session files
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and gen…
KEV Jun 2, 2025 -
Medium 5.3
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This…
KEV Jan 22, 2026 -
Medium 4.4CVE-2025-21590 Exploited
Junos OS: An local attacker with shell access can execute arbitrary code
An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrar…
KEV Mar 13, 2025 -
Medium 5.4CVE-2025-27915 Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulner…
KEV Oct 7, 2025 -
Medium 5.5CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
KEV Mar 11, 2025 -
Medium 4.6CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
KEV Mar 11, 2025 -
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 17, 2025 -
Medium 5.9CVE-2025-0111 Exploited
PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can gre…
KEV Feb 20, 2025 -
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certai…
KEV Feb 18, 2025 -
Medium 6.1CVE-2025-24200 Exploited
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.…
KEV Feb 12, 2025 -
Medium 5.8
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to e…
KEV Mar 10, 2025 -
Medium 6.6
Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
KEV Jan 13, 2025 -
Medium 4.4
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local f…
KEV Jan 7, 2025 -
Medium 6.3
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.…
KEV Nov 21, 2024 -
Medium 5.5CVE-2024-50302 Exploited
HID: core: zero-initialize the report buffer
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …
KEV Mar 4, 2025 -
Medium 5.9
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this…
KEV Nov 18, 2024 -
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or…
KEV Nov 18, 2024 -
Medium 5.3
Stored XSS vulnerability in MDaemon Email Server
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's brow…
KEV May 19, 2025 -
Medium 5.1
Limited remote code execution with privilege of a NetworkService Account access
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
KEV Aug 25, 2025 -
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
KEV Nov 12, 2024 -
Medium 5.1
Privilege escalation to NetworkService Account access
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
KEV Aug 25, 2025 -
Medium 5.8
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco …
KEV Oct 24, 2024 -
Medium 6.5
Windows MSHTML Platform Spoofing Vulnerability
Windows MSHTML Platform Spoofing Vulnerability
KEV Oct 8, 2024 -
Medium 6.5
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with a…
KEV Oct 9, 2024 -
Medium 5.4
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Sep 10, 2024 -
Medium 6.6CVE-2024-39717 Exploited
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only ava…
KEV Aug 23, 2024 -
Medium 6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Aug 13, 2024 -
Medium 6.1
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists i…
KEV May 19, 2025 -
Medium 6.8
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit,…
KEV Feb 12, 2025 -
Medium 5.3CVE-2024-39891 Exploited
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoi…
KEV Jul 23, 2024 -
Medium 6.0
Cisco NX-OS Software CLI Command Injection Vulnerability
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insuff…
KEV Jul 2, 2024 -
Medium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…
KEV Jul 30, 2024 -
Medium 6.1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
KEV Oct 24, 2024 -
Medium 5.5CVE-2024-27834 Exploited
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.…
KEV Nov 4, 2026 -
Medium 6.5
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not re…
KEV Sep 3, 2025 -
Medium 6.0
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been av…
KEV Apr 24, 2024 -
Medium 5.5CVE-2024-29745 Exploited
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure w…
KEV Apr 4, 2024 -
Medium 5.3
D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of th…
KEV Jun 25, 2025 -
Medium 5.5CVE-2023-6548 Exploited
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker wit…
KEV Jan 17, 2024 -
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024