Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
  • 9.8

    CRITICAL
    CVE-2015-8804

    x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.... Read more

    Affected Products : ubuntu_linux leap opensuse nettle
    • EPSS Score: %11.88
    • Published: Feb. 23, 2016
    • Modified: Apr. 12, 2025
  • 9.8

    CRITICAL
    CVE-2015-3249

    The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array... Read more

    Affected Products : traffic_server
    • EPSS Score: %3.61
    • Published: Oct. 30, 2017
    • Modified: Apr. 20, 2025
  • 9.8

    CRITICAL
    CVE-2014-9761

    Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf,... Read more

    • EPSS Score: %2.44
    • Published: Apr. 19, 2016
    • Modified: Apr. 12, 2025
  • 9.8

    CRITICAL
    CVE-2014-7862

    The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.... Read more

    Affected Products : desktop_central
    • EPSS Score: %81.40
    • Published: Jan. 04, 2018
    • Modified: Nov. 21, 2024
  • 9.8

    CRITICAL
    CVE-2014-4650

    The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code... Read more

    • EPSS Score: %14.86
    • Published: Feb. 20, 2020
    • Modified: Nov. 21, 2024
  • 9.8

    CRITICAL
    CVE-2014-4172

    A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary w... Read more

    • EPSS Score: %6.74
    • Published: Jan. 24, 2020
    • Modified: Nov. 21, 2024
  • 9.8

    CRITICAL
    CVE-2014-2914

    fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.... Read more

    Affected Products : fish
    • EPSS Score: %2.48
    • Published: Jan. 28, 2020
    • Modified: Nov. 21, 2024
  • 9.8

    CRITICAL
    CVE-2014-0234

    The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Open... Read more

    Affected Products : openshift
    • EPSS Score: %1.42
    • Published: Feb. 12, 2020
    • Modified: Nov. 21, 2024
  • 9.8

    CRITICAL
    CVE-2013-2251

    Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.... Read more

    • Actively Exploited
    • EPSS Score: %94.23
    • Published: Jul. 20, 2013
    • Modified: Apr. 11, 2025
  • 9.8

    CRITICAL
    CVE-2012-1891

    Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in m... Read more

    • EPSS Score: %59.64
    • Published: Jul. 10, 2012
    • Modified: Apr. 11, 2025
  • 9.8

    CRITICAL
    CVE-2011-4120

    Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common auth... Read more

    Affected Products : linux_kernel debian_linux pam_module
    • EPSS Score: %1.48
    • Published: Nov. 26, 2019
    • Modified: Nov. 21, 2024
  • 9.8

    CRITICAL
    CVE-2010-5325

    Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a long job title.... Read more

    • EPSS Score: %5.96
    • Published: Apr. 15, 2016
    • Modified: Apr. 12, 2025
  • 9.8

    CRITICAL
    CVE-2010-4042

    Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "stale elements."... Read more

    Affected Products : chrome opensuse
    • EPSS Score: %1.95
    • Published: Oct. 21, 2010
    • Modified: Apr. 11, 2025
  • 9.8

    CRITICAL
    CVE-2005-0408

    CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boog... Read more

    Affected Products : citrusdb
    • EPSS Score: %3.15
    • Published: Feb. 14, 2005
    • Modified: Apr. 03, 2025
  • 9.8

    CRITICAL
    CVE-2004-2061

    RiSearch 1.0.01 and RiSearch Pro 3.2.06 allows remote attackers to use the show.pl script as an open proxy, or read arbitrary local files, by setting the url parameter to a (1) http://, (2) ftp://, or (3) file:// URL.... Read more

    Affected Products : risearch risearch_pro
    • EPSS Score: %17.39
    • Published: Jul. 27, 2004
    • Modified: Apr. 03, 2025
  • 9.8

    CRITICAL
    CVE-2025-43275

    A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.... Read more

    Affected Products : macos
    • Published: Jul. 30, 2025
    • Modified: Jul. 31, 2025
    • Vuln Type: Race Condition
  • 9.8

    CRITICAL
    CVE-2025-30727

    Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t... Read more

    Affected Products : e-business_suite scripting
    • Published: Apr. 15, 2025
    • Modified: Apr. 28, 2025
    • Vuln Type: Authentication
  • 9.8

    CRITICAL
    CVE-2025-30406

    Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machin... Read more

    Affected Products : centrestack
    • Actively Exploited
    • Published: Apr. 03, 2025
    • Modified: Apr. 22, 2025
    • Vuln Type: Authentication
  • 9.8

    CRITICAL
    CVE-2025-32756

    A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through ... Read more

    • Actively Exploited
    • Published: May. 13, 2025
    • Modified: Aug. 25, 2025
    • Vuln Type: Memory Corruption
  • 9.8

    CRITICAL
    CVE-2025-24269

    The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to cause unexpected system termination.... Read more

    Affected Products : macos
    • Published: Mar. 31, 2025
    • Modified: Apr. 04, 2025
    • Vuln Type: Memory Corruption
Showing 20 of 291513 Results