Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 4.3

    MEDIUM
    CVE-2022-24446

    An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.... Read more

    Affected Products : manageengine_key_manager_plus
    • EPSS Score: %2.01
    • Published: Mar. 01, 2022
    • Modified: May. 30, 2025

  • 7.8

    HIGH
    CVE-2021-44035

    Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files.... Read more

    Affected Products : teammate_audit_management
    • EPSS Score: %0.18
    • Published: Dec. 17, 2021
    • Modified: May. 30, 2025

  • 8.1

    HIGH
    CVE-2021-43978

    Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.... Read more

    Affected Products : allegro
    • EPSS Score: %0.22
    • Published: Dec. 08, 2021
    • Modified: May. 30, 2025

  • 5.5

    MEDIUM
    CVE-2021-42111

    An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. If it is installed on a jailbroken device, it is possible to retrieve the PIN code used to access the application. The IOS app version 1.4.1631262629 resolves this issue by stori... Read more

    Affected Products : openotp_token
    • EPSS Score: %0.05
    • Published: Nov. 10, 2021
    • Modified: May. 30, 2025

  • 7.8

    HIGH
    CVE-2021-42110

    An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate privileges to SYSTEM if the FTP module is installed, because of DLL hijacking.... Read more

    Affected Products : allegro
    • EPSS Score: %0.06
    • Published: Dec. 08, 2021
    • Modified: May. 30, 2025

  • 5.5

    MEDIUM
    CVE-2021-41320

    A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed during installati... Read more

    Affected Products : wallstreet_suite
    • EPSS Score: %0.06
    • Published: Oct. 15, 2021
    • Modified: May. 30, 2025

  • 8.1

    HIGH
    CVE-2021-38618

    In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except the password) to get access to an account. This occurs because of JSESSIONID mismanagement.... Read more

    Affected Products : workforce_management
    • EPSS Score: %0.26
    • Published: Oct. 04, 2021
    • Modified: May. 30, 2025

  • 8.8

    HIGH
    CVE-2021-38617

    In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation.... Read more

    Affected Products : natural_language_processing
    • EPSS Score: %0.88
    • Published: Sep. 07, 2021
    • Modified: May. 30, 2025

  • 8.8

    HIGH
    CVE-2021-38616

    In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users'... Read more

    Affected Products : natural_language_processing
    • EPSS Score: %0.90
    • Published: Sep. 07, 2021
    • Modified: May. 30, 2025

  • 8.1

    HIGH
    CVE-2021-38615

    In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to view and modify information.... Read more

    Affected Products : natural_language_processing
    • EPSS Score: %0.34
    • Published: Sep. 07, 2021
    • Modified: May. 30, 2025

  • 8.5

    HIGH
    CVE-2021-32018

    An issue was discovered in JUMP AMS 3.6.0.04.009-2487. The JUMP SOAP API was vulnerable to arbitrary file reading due to an improper limitation of file loading on the server filesystem, aka directory traversal.... Read more

    Affected Products : asset_management
    • EPSS Score: %0.42
    • Published: Aug. 03, 2021
    • Modified: May. 30, 2025

  • 9.9

    CRITICAL
    CVE-2021-32017

    An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the listing of the content of the remote file system. This can be used to identify the complete server filesystem structure, i.e., identifying all the directories and fi... Read more

    Affected Products : asset_management
    • EPSS Score: %0.23
    • Published: Aug. 03, 2021
    • Modified: May. 30, 2025

  • 9.9

    CRITICAL
    CVE-2021-32016

    An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the writing of arbitrary files to a user-controlled location on the remote filesystem (with user-controlled content) via directory traversal, potentially leading to remo... Read more

    Affected Products : asset_management
    • EPSS Score: %0.81
    • Published: Aug. 03, 2021
    • Modified: May. 30, 2025

  • 4.9

    MEDIUM
    CVE-2021-31777

    The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.... Read more

    Affected Products : dynamic_content_elements
    • EPSS Score: %0.29
    • Published: Apr. 28, 2021
    • Modified: May. 30, 2025

  • 9.8

    CRITICAL
    CVE-2021-31531

    Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).... Read more

    Affected Products : manageengine_servicedesk_plus_msp
    • EPSS Score: %5.64
    • Published: Jun. 29, 2021
    • Modified: May. 30, 2025

  • 7.5

    HIGH
    CVE-2021-31530

    Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.... Read more

    Affected Products : manageengine_servicedesk_plus_msp
    • EPSS Score: %1.56
    • Published: Jun. 29, 2021
    • Modified: May. 30, 2025

  • 5.9

    MEDIUM
    CVE-2021-31399

    On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack.... Read more

    • EPSS Score: %0.21
    • Published: Aug. 13, 2021
    • Modified: May. 30, 2025

  • 7.5

    HIGH
    CVE-2021-31160

    Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.... Read more

    • EPSS Score: %10.02
    • Published: Jun. 29, 2021
    • Modified: May. 30, 2025

  • 4.3

    MEDIUM
    CVE-2020-8422

    An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, cred... Read more

    Affected Products : manageengine_remote_access_plus
    • EPSS Score: %0.27
    • Published: Jan. 31, 2020
    • Modified: May. 30, 2025

  • 5.3

    MEDIUM
    CVE-2020-28918

    DualShield 5.9.8.0821 allows username enumeration on its login form. A valid username results in prompting for the password, whereas an invalid one will produce an "unknown username" error message.... Read more

    Affected Products : dualshield
    • EPSS Score: %0.30
    • Published: Feb. 16, 2021
    • Modified: May. 30, 2025
Showing 20 of 292759 Results