Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 4.7

    MEDIUM
    CVE-2023-3439

    A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs ob... Read more

    Affected Products : linux_kernel
    • Published: Jun. 28, 2023
    • Modified: Jun. 25, 2025

  • 5.5

    MEDIUM
    CVE-2023-6622

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.... Read more

    Affected Products : linux_kernel enterprise_linux fedora
    • Published: Dec. 08, 2023
    • Modified: Jun. 25, 2025

  • 7.5

    HIGH
    CVE-2024-25617

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote clien... Read more

    Affected Products : squid bluexp
    • Published: Feb. 14, 2024
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42389

    Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42390

    Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42391

    Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.1

    HIGH
    CVE-2021-42387

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the len... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.1

    HIGH
    CVE-2021-42388

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the len... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2021-43304

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2021-43305

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2019-15024

    In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse re... Read more

    Affected Products : clickhouse clickhouse
    • Published: Dec. 30, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2019-16535

    In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Dec. 30, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2018-14670

    Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2018-14671

    In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2018-14668

    In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 5.3

    MEDIUM
    CVE-2019-18657

    ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Oct. 31, 2019
    • Modified: Jun. 25, 2025

  • 7.5

    HIGH
    CVE-2018-14669

    ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 5.3

    MEDIUM
    CVE-2018-14672

    In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2025-26909

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through 5.4.01.... Read more

    Affected Products : hide_my_wp_ghost
    • Published: Mar. 27, 2025
    • Modified: Jun. 25, 2025
    • Vuln Type: Path Traversal

  • 4.8

    MEDIUM
    CVE-2024-11847

    The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.... Read more

    Affected Products : _wp_svg_upload
    • Published: Mar. 26, 2025
    • Modified: Jun. 25, 2025
    • Vuln Type: Cross-Site Scripting
Showing 20 of 294071 Results