Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,975
- Last 24h
- 1,882
- Critical, 7 days
- 354
- Known exploited
- 1,779
107,888 results · Clear filters · Feed
-
Medium 5.4
UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof U…
-
Medium 6.5
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging soci…
-
Medium 6.5
Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…
-
Medium 6.5
Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass syste…
-
Medium 6.5
Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin pol…
-
Medium 5.5
Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtai…
-
Medium 6.5
Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-o…
-
Medium 5.4
UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social eng…
-
Medium 6.5
Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging so…
-
Medium 6.5
Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass w…
-
Medium 6.5
Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin da…
-
Medium 6.5
Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-orig…
-
Medium 6.5
UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof add…
-
Medium 4.3
Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sa…
-
Medium 6.5
Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origi…
-
Medium 6.5
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2…
-
Medium 6.3
Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to mak…
-
Medium 6.5
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and e…
-
Medium 5.3
Headless CMS Plugin REST API post get_required_post_data information disclosure
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in inf…
-
Medium 5.2
TinyUSB < 0.21.0 Integer Underflow via HID Report Descriptor Parser
TinyUSB before 0.21.0 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item…
-
Medium 6.8
TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()
TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted …
-
Medium 6.5
Authenticated Buffer Overflow Vulnerability Leads to Denial-of-Service in HPE Networking VIA
A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected system.
-
Medium 6.5
Authenticated Sensitive Information Disclosure in VIA
A sensitive information disclosure vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated attacker to obtain sensitive information.
-
Medium 6.7
Unescaped header separators in whatstk build a regular expression that backtracks exponentially
Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because…
-
Medium 6.8
MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-…
-
Medium 4.2
Authenticated Race Condition in API of HPE Networking Fabric Composer
A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.
-
Medium 4.3
Authenticated Information Disclosure in HPE Networking Fabric Composer API Endpoint
An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system.
-
Medium 4.7
Authenticated Local Sensitive Information Disclosure in HPE Networking Fabric Composer
A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the att…
-
Medium 5.3
Unauthenticated Audit Log Spoofing in API of HPE Networking Fabric Composer
An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.
-
Medium 5.3
Privilege Escalation Leading to Information Disclosure in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attacker to obtain sensitiv…
-
Medium 5.3
Unauthenticated Information Disclosure in HPE Networking Fabric Composer
An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.
-
Medium 5.3
Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer
Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information. Successful exploitation could allow an attacker to disclose sensitive information.
-
Medium 5.4
Unauthenticated Sensitive Information Disclosure in Web-Based Management Interface of HPE Networking Fabric Composer
A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information.
-
Medium 5.7
Unauthenticated Adjacent Improper Certificate Validation in HPE Networking Fabric Composer
An improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to access sensitive information.
-
Medium 5.9
Unauthenticated Improper Certificate Validation allows Information Disclosure in HPE Networking Fabric Composer
An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could…
-
Medium 5.9
Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric Composer
An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain p…
-
Medium 5.9
Authenticated Improper Certificate Validation leads to Information Disclosure in HPE Networking Fabric Composer
An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to obtain sensitive information.
-
Medium 6.4
Privilege Escalation Vulnerability in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated attacker with low privileges to gain elevated pri…
-
Medium 6.5
Authenticated Audit Log Bypass in the API of HPE Networking Fabric Composer
Audit log bypass vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to suppress the audit records of their activity on the affected system.
-
Medium 6.5
Authentication Bypass Vulnerability in HPE Networking Fabric Composer API
A local authentication bypass vulnerability exists in an API of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to write arbitrary files to remote servers configured on the affected system.