Latest vulnerabilities

214 results · Clear filters · Feed

• Medium 6.5
  CVE-2023-42916 Exploited EPSS 18%

  An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2…

  Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu
  Nov 30, 2023

  KEV Dec 4, 2023
• Medium 6.1
  CVE-2023-5631 Exploited EPSS 76%

  Stored XSS vulnerability in Roundcube

  Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary Java…

  Roundcube Roundcubemail roundcube roundcube Debian Ubuntu
  Oct 18, 2023

  KEV Oct 26, 2023
• Medium 6.5
  CVE-2023-36563 Exploited EPSS 20%

  Microsoft WordPad Information Disclosure Vulnerability

  Microsoft WordPad Information Disclosure Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Oct 10, 2023

  KEV Oct 10, 2023
• Medium 5.4
  CVE-2023-36584 Exploited

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Oct 10, 2023

  KEV Nov 16, 2023
• Medium 5.3
  CVE-2023-41763 Exploited EPSS 90%

  Skype for Business Elevation of Privilege Vulnerability

  Skype for Business Elevation of Privilege Vulnerability

  Microsoft Skype for Business Server 2015 CU13 Skype for Business Server 2019 CU7
  Oct 10, 2023

  KEV Oct 10, 2023
• Medium 5.5
  CVE-2023-4211 Exploited

  Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations

  A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

  Arm Valhall GPU Kernel Driver Arm 5th Gen GPU Architecture Kernel Driver Bifrost GPU Kernel Driver
  Oct 1, 2023

  KEV Oct 3, 2023
• Medium 6.6
  CVE-2023-20109 Exploited

  A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Sof…

  Cisco Cisco IOS XE Software IOS iOS Network devices
  Sep 27, 2023

  KEV Oct 10, 2023
• Medium 5.3
  CVE-2023-36851 Exploited

  Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

  A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php th…

  Juniper Networks Junos OS Network devices
  Sep 26, 2023

  KEV Nov 13, 2023
• Medium 6.1
  CVE-2023-43770 Exploited Public exploit EPSS 64%

  Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…

  roundcube roundcube Debian Ubuntu
  Sep 22, 2023

  KEV Feb 12, 2024
• Medium 5.5
  CVE-2023-41991 Exploited Public exploit EPSS 13%

  A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A ma…

  Apple macOS iOS and iPadOS macOS iOS
  Sep 21, 2023

  KEV Sep 25, 2023
• Medium 6.5
  CVE-2023-36761 Exploited EPSS 20%

  Microsoft Word Information Disclosure Vulnerability

  Microsoft Word Information Disclosure Vulnerability

  Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019
  Sep 12, 2023

  KEV Sep 12, 2023
• Medium 5.0
  CVE-2023-20269 Exploited · Ransomware EPSS 27%

  A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepowe…

  Cisco Cisco Firepower Threat Defense Software Cisco Adaptive Security Appliance (ASA) Software Network devices
  Sep 6, 2023

  KEV Sep 13, 2023
• Medium 5.3
  CVE-2023-36846 Exploited Public exploit EPSS 93%

  Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

  A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't re…

  Juniper Networks Junos OS Network devices
  Aug 17, 2023

  KEV Nov 13, 2023
• Medium 5.3
  CVE-2023-36844 Exploited Public exploit EPSS 90%

  Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

  A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify …

  Juniper Networks Junos OS Network devices
  Aug 17, 2023

  KEV Nov 13, 2023
• Medium 5.3
  CVE-2023-36847 Exploited EPSS 83%

  Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

  A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php tha…

  Juniper Networks Junos OS Network devices
  Aug 17, 2023

  KEV Nov 13, 2023
• Medium 6.1
  CVE-2023-37580 Exploited EPSS 49%

  Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

  Jul 31, 2023

  KEV Jul 27, 2023
• Medium 5.5
  CVE-2023-38606 Exploited

  This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and i…

  Apple macOS iOS and iPadOS watchOS macOS iOS
  Jul 26, 2023

  KEV Jul 26, 2023
• Medium 6.2
  CVE-2023-21237 Exploited

  In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification…

  Android
  Jun 28, 2023

  KEV Mar 5, 2024
• Medium 6.5
  CVE-2023-28204 Exploited EPSS 14%

  An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macO…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Jun 23, 2023

  KEV May 22, 2023
• Medium 4.4
  CVE-2023-21492 Exploited

  Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypas…

  Samsung Mobile Samsung Mobile Devices
  May 4, 2023

  KEV May 19, 2023
• Medium 6.5
  CVE-2023-20118 Exploited EPSS 54%

  A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV32…

  Cisco Cisco Small Business RV Series Router Firmware Network devices
  Apr 5, 2023

  KEV Mar 3, 2025
• Medium 4.4
  CVE-2023-24880 Exploited · Ransomware EPSS 78%

  Windows SmartScreen Security Feature Bypass Vulnerability

  Windows SmartScreen Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Mar 14, 2023

  KEV Mar 14, 2023
• Medium 6.5
  CVE-2022-41328 Exploited EPSS 11%

  A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet For…

  Fortinet FortiOS Network devices
  Mar 7, 2023

  KEV Mar 14, 2023
• Medium 5.3
  CVE-2023-23752 Exploited Public exploit EPSS 100%

  [20230201] - Core - Improper access check in webservice endpoints

  An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

  Joomla! Project Joomla! CMS Web / CMS
  Feb 16, 2023

  KEV Jan 8, 2024
• Medium 5.4
  CVE-2022-44698 Exploited · Ransomware EPSS 75%

  Windows SmartScreen Security Feature Bypass Vulnerability

  Windows SmartScreen Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2022 Windows
  Dec 13, 2022

  KEV Dec 13, 2022
• Medium 6.8
  CVE-2022-40765 Exploited · Ransomware EPSS 11%

  A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authe…

  Nov 22, 2022

  KEV Feb 21, 2023
• Medium 6.8
  CVE-2022-41223 Exploited · Ransomware EPSS 11%

  The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to…

  Nov 22, 2022

  KEV Feb 21, 2023
• Medium 5.4
  CVE-2022-41049 Exploited

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Nov 9, 2022

  KEV Nov 14, 2022
• Medium 5.4
  CVE-2022-41091 Exploited · Ransomware

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Windows Mark of the Web Security Feature Bypass Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Nov 9, 2022

  KEV Nov 8, 2022
• Medium 6.5
  CVE-2022-2856 Exploited

  Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a rem…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  Sep 26, 2022

  KEV Aug 18, 2022
• Medium 6.1
  CVE-2022-39197 Exploited Public exploit EPSS 44%

  An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…

  Sep 22, 2022

  KEV Mar 30, 2023
• Medium 5.5
  CVE-2022-22674 Exploited

  An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input…

  Apple macOS macOS
  May 26, 2022

  KEV Apr 4, 2022
• Medium 6.5
  CVE-2022-20821 Exploited EPSS 11%

  Cisco IOS XR Software Health Check Open Port Vulnerability

  A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379…

  Cisco Cisco IOS XR Software iOS Network devices
  May 26, 2022

  KEV May 23, 2022
• Medium 6.1
  CVE-2022-27926 Exploited EPSS 18%

  A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaborati…

  Apr 20, 2022

  KEV Apr 3, 2023
• Medium 6.8
  CVE-2022-28810 Exploited Public exploit EPSS 71%

  Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary…

  Apr 18, 2022

  KEV Mar 7, 2023
• Medium 6.5
  CVE-2022-22948 Exploited Public exploit EPSS 13%

  The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…

  Virtualization
  Mar 29, 2022

  KEV Jul 17, 2024
• Medium 6.1
  CVE-2022-24682 Exploited · Ransomware EPSS 31%

  An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), …

  Feb 9, 2022

  KEV Feb 25, 2022
• Medium 6.6
  CVE-2021-22600 Exploited Public exploit

  Double Free in net/packet/af_packet.c leading to priviledge escalation

  A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…

  Linux kernel kernel linux-raspi2 linux-hwe Debian Ubuntu
  Jan 26, 2022

  KEV Apr 11, 2022
• Medium 4.3
  CVE-2021-35247 Exploited

  Improper Input Validation Vulnerability in Serv-U

  Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as t…

  SolarWinds Serv-U
  Jan 7, 2022

  KEV Jan 21, 2022
• Medium 5.0
  CVE-2022-22265 Exploited

  An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary …

  Samsung Mobile Samsung Mobile Devices
  Jan 7, 2022

  KEV Sep 18, 2023