Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 5.5

    MEDIUM
    CVE-2022-4127

    A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service.... Read more

    Affected Products : linux_kernel
    • Published: Nov. 28, 2022
    • Modified: Jun. 25, 2025

  • 5.5

    MEDIUM
    CVE-2022-4128

    A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service.... Read more

    Affected Products : linux_kernel mptcp_protocol
    • Published: Nov. 28, 2022
    • Modified: Jun. 25, 2025

  • 4.7

    MEDIUM
    CVE-2023-26545

    In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.... Read more

    • Published: Feb. 25, 2023
    • Modified: Jun. 25, 2025

  • 7.5

    HIGH
    CVE-2023-5632

    In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denia... Read more

    Affected Products : mosquitto
    • Published: Oct. 18, 2023
    • Modified: Jun. 25, 2025

  • 4.7

    MEDIUM
    CVE-2023-3439

    A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs ob... Read more

    Affected Products : linux_kernel
    • Published: Jun. 28, 2023
    • Modified: Jun. 25, 2025

  • 5.5

    MEDIUM
    CVE-2023-6622

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.... Read more

    Affected Products : linux_kernel enterprise_linux fedora
    • Published: Dec. 08, 2023
    • Modified: Jun. 25, 2025

  • 7.5

    HIGH
    CVE-2024-25617

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote clien... Read more

    Affected Products : squid bluexp
    • Published: Feb. 14, 2024
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42389

    Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42390

    Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42391

    Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.1

    HIGH
    CVE-2021-42387

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the len... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.1

    HIGH
    CVE-2021-42388

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the len... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2021-43304

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2021-43305

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2019-15024

    In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse re... Read more

    Affected Products : clickhouse clickhouse
    • Published: Dec. 30, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2019-16535

    In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Dec. 30, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2018-14670

    Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2018-14671

    In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2018-14668

    In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 5.3

    MEDIUM
    CVE-2019-18657

    ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Oct. 31, 2019
    • Modified: Jun. 25, 2025
Showing 20 of 294155 Results