Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked: 408,817
Last 24h: 2,072
Critical, 7 days: 349
Known exploited: 1,779

All Critical High Medium Low Exploited only Public exploit

214 results · Clear filters · Feed

Medium 6.4

CVE-2021-0920 Exploited

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Dec 15, 2021
KEV May 23, 2022
Medium 6.8

CVE-2021-39935 Exploited EPSS 36%

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions star…

GitLab GitLab gitlab Web / CMS Ubuntu

Dec 13, 2021
KEV Feb 3, 2026
Medium 6.1

CVE-2021-38000 Exploited

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remot…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 23, 2021
KEV Nov 3, 2021
Medium 5.5

CVE-2021-41379 Exploited · Ransomware EPSS 19%

Windows Installer Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Nov 10, 2021
KEV Mar 3, 2022
Medium 6.5

CVE-2021-37976 Exploited EPSS 20%

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain poten…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Oct 8, 2021
KEV Nov 3, 2021
Medium 6.5

CVE-2021-20035 Exploited

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker t…

SonicWall SMA100 Network devices

Sep 27, 2021
KEV Apr 16, 2025
Medium 5.3

CVE-2021-22017 Exploited EPSS 49%

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mal…

Virtualization

Sep 23, 2021
KEV Jan 10, 2022
Medium 5.5

CVE-2021-30657 Exploited Public exploit EPSS 69%

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …

Apple macOS macOS

Sep 8, 2021
KEV Nov 3, 2021
Medium 5.3

CVE-2021-26086 Exploited Public exploit EPSS 100%

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path t…

Atlassian Jira Server Jira Data Center Web / CMS

Aug 16, 2021
KEV Nov 12, 2024
Medium 5.3

CVE-2021-26085 Exploited · Ransomware Public exploit EPSS 100%

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…

Atlassian Confluence Server Confluence Data Center Web / CMS

Aug 3, 2021
KEV Mar 28, 2022
Medium 6.8

CVE-2021-34448 Exploited EPSS 40%

Scripting Engine Memory Corruption Vulnerability

Scripting Engine Memory Corruption Vulnerability

Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2016 Windows

Jul 16, 2021
KEV Nov 3, 2021
Medium 6.8

CVE-2021-22175 Exploited EPSS 53%

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab a…

GitLab GitLab gitlab Web / CMS Ubuntu

Jun 11, 2021
KEV Feb 18, 2026
Medium 6.4

CVE-2021-25394 Exploited

A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrar…

Samsung Mobile Samsung Mobile Devices

Jun 11, 2021
KEV Jun 29, 2023
Medium 6.4

CVE-2021-25395 Exploited

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check…

Samsung Mobile Samsung Mobile Devices

Jun 11, 2021
KEV Jun 29, 2023
Medium 5.4

CVE-2021-26829 Exploited EPSS 48%

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

Jun 11, 2021
KEV Nov 28, 2025
Medium 5.5

CVE-2021-31955 Exploited Public exploit EPSS 81%

Windows Kernel Information Disclosure Vulnerability

Windows Kernel Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 5.2

CVE-2021-31199 Exploited

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 5.2

CVE-2021-31201 Exploited

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jun 8, 2021
KEV Nov 3, 2021
Medium 6.5

CVE-2021-30533 Exploited EPSS 17%

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine

Jun 7, 2021
KEV Jun 27, 2022
Medium 5.5

CVE-2021-27562 Exploited

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the prin…

May 25, 2021
KEV Nov 3, 2021
Medium 6.6

CVE-2021-31207 Exploited · Ransomware Public exploit EPSS 100%

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19

May 11, 2021
KEV Nov 3, 2021
Medium 6.2

CVE-2021-1906 Exploited

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Au…

Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

May 7, 2021
KEV Nov 3, 2021
Medium 6.8

CVE-2021-22204 Exploited Public exploit EPSS 100%

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…

ExifTool ExifTool libimage-exiftool-perl libimage-exiftool-perl Debian Ubuntu Alpine

Apr 23, 2021
KEV Nov 17, 2021
Medium 4.9

CVE-2021-20023 Exploited · Ransomware EPSS 52%

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an…

SonicWall Email Security Network devices

Apr 20, 2021
KEV Nov 3, 2021
Medium 6.1

CVE-2021-1879 Exploited

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and …

Apple iOS and iPadOS watchOS iOS iOS

Apr 2, 2021
KEV Nov 3, 2021
Medium 6.1

CVE-2021-25372 Exploited

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

Samsung Mobile Samsung Mobile Devices

Mar 26, 2021
KEV Jun 29, 2023
Medium 6.1

CVE-2021-25371 Exploited

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

Samsung Mobile Samsung Mobile Devices

Mar 26, 2021
KEV Jun 29, 2023
Medium 6.1

CVE-2021-25370 Exploited

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory co…

Samsung Mobile Samsung Mobile Devices

Mar 26, 2021
KEV Nov 8, 2022
Medium 6.2

CVE-2021-25369 Exploited

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel infor…

Samsung Mobile Samsung Mobile Devices

Mar 26, 2021
KEV Nov 8, 2022
Medium 4.4

CVE-2021-25337 Exploited Public exploit

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…

Samsung Mobile Samsung Mobile Devices

Mar 4, 2021
KEV Nov 8, 2022
Medium 5.3

CVE-2021-21973 Exploited Public exploit EPSS 88%

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…

Virtualization

Feb 24, 2021
KEV Mar 7, 2022
Medium 6.1

CVE-2020-35730 Exploited Public exploit EPSS 33%

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attac…

roundcube roundcube Debian Ubuntu

Dec 28, 2020
KEV Jun 22, 2023
Medium 5.5

CVE-2020-27950 Exploited Public exploit EPSS 17%

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watc…

Apple macOS iOS and iPadOS watchOS macOS iOS

Dec 8, 2020
KEV Nov 3, 2021
Medium 6.1

CVE-2018-19953 Exploited · Ransomware EPSS 31%

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…

QNAP Systems QTS

Oct 28, 2020
KEV May 24, 2022
Medium 6.1

CVE-2020-3580 Exploited · Ransomware Public exploit EPSS 86%

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against …

Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices

Oct 21, 2020
KEV Nov 3, 2021
Medium 5.5

CVE-2020-9934 Exploited Public exploit

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…

Apple macOS iOS macOS iOS

Oct 16, 2020
KEV Sep 8, 2022
Medium 4.2

CVE-2020-0878 Exploited · Ransomware

Microsoft Browser Memory Corruption Vulnerability

<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker…

Microsoft ChakraCore Internet Explorer 11 Internet Explorer 9 Browsers

Sep 11, 2020
KEV Nov 3, 2021
Medium 5.5

CVE-2020-1472 Exploited · Ransomware Public exploit EPSS 99%

Netlogon Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could ru…

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2016 Windows Debian Ubuntu Alpine

Aug 17, 2020
KEV Nov 3, 2021
Medium 6.5

CVE-2019-5591 Exploited · Ransomware Public exploit EPSS 19%

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …

Fortinet Fortinet FortiOS Network devices

Aug 14, 2020
KEV Nov 3, 2021
Medium 4.3

CVE-2020-8196 Exploited EPSS 26%

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…

Jul 10, 2020
KEV Nov 3, 2021

Latest vulnerabilities

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions star…

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remot…

Windows Installer Elevation of Privilege Vulnerability

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain poten…

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker t…

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mal…

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update …

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path t…

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…

Scripting Engine Memory Corruption Vulnerability

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab a…

A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrar…

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check…

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

Windows Kernel Information Disclosure Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp…

In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the prin…

Microsoft Exchange Server Security Feature Bypass Vulnerability

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Au…

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an…

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and …

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory co…

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel infor…

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attac…

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watc…

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…

Microsoft Browser Memory Corruption Vulnerability

Netlogon Elevation of Privilege Vulnerability

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…