Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 7.5

    HIGH
    CVE-2021-25293

    An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.... Read more

    Affected Products : pillow
    • EPSS Score: %0.12
    • Published: Mar. 19, 2021
    • Modified: Nov. 21, 2024

  • 6.5

    MEDIUM
    CVE-2021-25292

    An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.... Read more

    Affected Products : pillow
    • EPSS Score: %0.16
    • Published: Mar. 19, 2021
    • Modified: Nov. 21, 2024

  • 7.5

    HIGH
    CVE-2021-25291

    An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.... Read more

    Affected Products : pillow
    • EPSS Score: %0.54
    • Published: Mar. 19, 2021
    • Modified: Nov. 21, 2024

  • 7.5

    HIGH
    CVE-2021-25290

    An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.... Read more

    Affected Products : debian_linux pillow
    • EPSS Score: %0.18
    • Published: Mar. 19, 2021
    • Modified: Nov. 21, 2024

  • 9.8

    CRITICAL
    CVE-2021-25289

    An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for C... Read more

    Affected Products : pillow
    • EPSS Score: %0.21
    • Published: Mar. 19, 2021
    • Modified: Nov. 21, 2024

  • 9.1

    CRITICAL
    CVE-2021-25288

    An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.... Read more

    Affected Products : fedora pillow
    • EPSS Score: %0.20
    • Published: Jun. 02, 2021
    • Modified: Nov. 21, 2024

  • 9.1

    CRITICAL
    CVE-2021-25287

    An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.... Read more

    Affected Products : fedora pillow
    • EPSS Score: %0.26
    • Published: Jun. 02, 2021
    • Modified: Nov. 21, 2024

  • 4.4

    MEDIUM
    CVE-2021-25284

    An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.... Read more

    Affected Products : fedora debian_linux salt
    • EPSS Score: %0.02
    • Published: Feb. 27, 2021
    • Modified: Nov. 21, 2024

  • 9.8

    CRITICAL
    CVE-2021-25283

    An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.... Read more

    Affected Products : fedora debian_linux salt
    • EPSS Score: %7.44
    • Published: Feb. 27, 2021
    • Modified: Nov. 21, 2024

  • 9.1

    CRITICAL
    CVE-2021-25282

    An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.... Read more

    Affected Products : fedora debian_linux salt
    • EPSS Score: %91.16
    • Published: Feb. 27, 2021
    • Modified: Nov. 21, 2024

  • 9.8

    CRITICAL
    CVE-2021-25281

    An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.... Read more

    Affected Products : fedora debian_linux salt
    • EPSS Score: %94.01
    • Published: Feb. 27, 2021
    • Modified: Nov. 21, 2024

  • 4.8

    MEDIUM
    CVE-2021-25278

    FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.... Read more

    Affected Products : ftapi
    • EPSS Score: %0.28
    • Published: Mar. 19, 2021
    • Modified: Nov. 21, 2024

  • 6.1

    MEDIUM
    CVE-2021-25277

    FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.... Read more

    Affected Products : ftapi
    • EPSS Score: %0.28
    • Published: Mar. 19, 2021
    • Modified: Nov. 21, 2024

  • 7.1

    HIGH
    CVE-2021-25276

    In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an F... Read more

    Affected Products : serv-u
    • EPSS Score: %0.25
    • Published: Feb. 03, 2021
    • Modified: Nov. 21, 2024

  • 7.8

    HIGH
    CVE-2021-25275

    SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access... Read more

    Affected Products : orion_platform
    • EPSS Score: %0.11
    • Published: Feb. 03, 2021
    • Modified: Nov. 21, 2024

  • 10.0

    HIGH
    CVE-2021-25274

    The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Ser... Read more

    Affected Products : orion_platform
    • EPSS Score: %64.37
    • Published: Feb. 03, 2021
    • Modified: Nov. 21, 2024

  • 4.8

    MEDIUM
    CVE-2021-25273

    Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.... Read more

    Affected Products : unified_threat_management
    • EPSS Score: %0.14
    • Published: Jul. 29, 2021
    • Modified: Nov. 21, 2024

  • 6.0

    MEDIUM
    CVE-2021-25271

    A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.... Read more

    Affected Products : hitmanpro
    • EPSS Score: %0.05
    • Published: Oct. 08, 2021
    • Modified: Nov. 21, 2024

  • 7.2

    HIGH
    CVE-2021-25270

    A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.... Read more

    Affected Products : hitmanpro.alert
    • EPSS Score: %0.05
    • Published: Oct. 08, 2021
    • Modified: Nov. 21, 2024

  • 4.4

    MEDIUM
    CVE-2021-25269

    A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23... Read more

    • EPSS Score: %0.05
    • Published: Nov. 26, 2021
    • Modified: Nov. 21, 2024
Showing 20 of 291368 Results