Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,811
- Last 24h
- 2,095
- Critical, 7 days
- 348
- Known exploited
- 1,779
107,767 results · Clear filters · Feed
-
Medium 6.9
Out-of-bounds write for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers …
-
Medium 6.3
Incorrect default permissions for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow a…
-
Medium 5.4
Insecure inherited permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications m…
-
Medium 6.8
Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring 1: Device Drivers may allow a denial of service.…
-
Medium 5.4
Incorrect default permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications ma…
-
Medium 5.4
Uncontrolled search path for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may all…
-
Medium 5.4
Incorrect default permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications ma…
-
Medium 6.8
AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Heap-based Buffer Overflow” by local …
-
Medium 6.8
AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Write” by local access.…
-
Medium 4.8
AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access. …
-
Medium 4.6
AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. …
-
Medium 4.9
Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker…
-
Medium 6.3
A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has aut…
-
Medium 4.5
Insufficient Input Validation Vulnerability in NETGEAR Orbi RBR350
An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compr…
-
Medium 5.5
An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authentic…
-
Medium 4.9
Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attac…
-
Medium 4.9
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
Medium 6.7
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
Medium 5.5
A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated …
-
Medium 5.5
An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 1…
-
Medium 6.7
Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with…
-
Medium 5.9
Information exposure in Flock Safety Platform public access-list sign-up
An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a registered vehicle's license…
-
Medium 6.8
Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows …
-
Medium 4.3
A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3…
-
Medium 6.3
Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to…
-
Medium 5.9
postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation
postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own s…
-
Medium 5.9
ABP Framework before 10.6.2 and 10.7.0 Path Traversal via Blogging File Endpoints
ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded ba…
-
Medium 5.0
Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus
Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-sco…
-
Medium 4.3
Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation
Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactab…
-
Medium 4.2
TaxHacker through 0.8.5 IDOR via Settings Server Actions userId
TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCa…
-
Medium 5.3
ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that al…
-
Medium 5.7
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to a…
-
Medium 6.5
Podman: untrusted image labels allow auto-update to restart arbitrary systemd units
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart.…
-
Medium 4.3
Information disclosure in the Marionette component
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Medium 4.3
Information disclosure in the Layout component
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Medium 4.3
Information disclosure in the Security: RLBox component
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Layout: Form Controls component
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Address Bar component
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Private Browsing component
Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 5.3
NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could c…