Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 7.5

    HIGH
    CVE-2024-38479

    Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which d... Read more

    Affected Products : traffic_server
    • Published: Nov. 14, 2024
    • Modified: Jun. 03, 2025

  • 8.8

    HIGH
    CVE-2024-45034

    Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are ad... Read more

    Affected Products : airflow
    • Published: Sep. 07, 2024
    • Modified: Jun. 03, 2025

  • 8.8

    HIGH
    CVE-2024-45498

    Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAG... Read more

    Affected Products : airflow
    • Published: Sep. 07, 2024
    • Modified: Jun. 03, 2025

  • 7.5

    HIGH
    CVE-2024-45784

    Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized u... Read more

    Affected Products : airflow
    • Published: Nov. 15, 2024
    • Modified: Jun. 03, 2025

  • 8.1

    HIGH
    CVE-2024-45033

    Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to ... Read more

    Affected Products : apache-airflow-providers-fab
    • Published: Jan. 08, 2025
    • Modified: Jun. 03, 2025
    • Vuln Type: Authentication

  • 6.3

    MEDIUM
    CVE-2025-27018

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cau... Read more

    Affected Products : apache-airflow-providers-mysql
    • Published: Mar. 19, 2025
    • Modified: Jun. 03, 2025
    • Vuln Type: Injection

  • 7.5

    HIGH
    CVE-2024-31309

    HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_... Read more

    Affected Products : fedora debian_linux traffic_server
    • Published: Apr. 10, 2024
    • Modified: Jun. 03, 2025

  • 9.8

    CRITICAL
    CVE-2021-32030

    The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administr... Read more

    • Actively Exploited
    • Published: May. 06, 2021
    • Modified: Jun. 03, 2025

  • 8.8

    HIGH
    CVE-2024-23222

    A type confusion issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this... Read more

    Affected Products : macos iphone_os tvos ipados
    • Actively Exploited
    • Published: Jan. 23, 2024
    • Modified: Jun. 03, 2025

  • 6.9

    MEDIUM
    CVE-2025-35939

    Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and... Read more

    Affected Products : craft_cms
    • Actively Exploited
    • Published: May. 07, 2025
    • Modified: Jun. 03, 2025
    • Vuln Type: Misconfiguration

  • 8.8

    HIGH
    CVE-2023-39780

    On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refres... Read more

    Affected Products : rt-ax55_firmware rt-ax55
    • Actively Exploited
    • Published: Sep. 11, 2023
    • Modified: Jun. 03, 2025

  • 9.8

    CRITICAL
    CVE-2024-56145

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspeci... Read more

    Affected Products : craft_cms
    • Actively Exploited
    • Published: Dec. 18, 2024
    • Modified: Jun. 03, 2025

  • 6.1

    MEDIUM
    CVE-2019-9978

    The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.... Read more

    Affected Products : social_warfare social_warfare_pro
    • Actively Exploited
    • Published: Mar. 24, 2019
    • Modified: Jun. 03, 2025

  • 9.8

    CRITICAL
    CVE-2024-23741

    An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.... Read more

    Affected Products : macos hyper hyper
    • Published: Jan. 28, 2024
    • Modified: Jun. 03, 2025

  • 5.4

    MEDIUM
    CVE-2024-23553

    A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. ... Read more

    Affected Products : bigfix_platform
    • Published: Feb. 02, 2024
    • Modified: Jun. 03, 2025

  • 6.2

    MEDIUM
    CVE-2024-23550

    HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent. ... Read more

    Affected Products : hcl_launch hcl_devops_deploy
    • Published: Feb. 03, 2024
    • Modified: Jun. 03, 2025

  • 4.8

    MEDIUM
    CVE-2024-22241

    Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the login banner and takeover the user account.   ... Read more

    Affected Products : aria_operations_for_networks
    • Published: Feb. 06, 2024
    • Modified: Jun. 03, 2025

  • 6.4

    MEDIUM
    CVE-2024-22238

    Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile configurations due to improper input sanitization. ... Read more

    Affected Products : aria_operations_for_networks
    • Published: Feb. 06, 2024
    • Modified: Jun. 03, 2025

  • 5.5

    MEDIUM
    CVE-2024-22236

    In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the sh... Read more

    Affected Products : spring_cloud_contract
    • Published: Jan. 31, 2024
    • Modified: Jun. 03, 2025

  • 8.8

    HIGH
    CVE-2024-22022

    Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.... Read more

    • Published: Feb. 07, 2024
    • Modified: Jun. 03, 2025
Showing 20 of 292791 Results