Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 6.5

    MEDIUM
    CVE-2021-42389

    Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42390

    Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2021-42391

    Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.1

    HIGH
    CVE-2021-42387

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the len... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.1

    HIGH
    CVE-2021-42388

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the len... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2021-43304

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2021-43305

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end... Read more

    Affected Products : debian_linux clickhouse clickhouse
    • Published: Mar. 14, 2022
    • Modified: Jun. 25, 2025

  • 6.5

    MEDIUM
    CVE-2019-15024

    In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse re... Read more

    Affected Products : clickhouse clickhouse
    • Published: Dec. 30, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2019-16535

    In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Dec. 30, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2018-14670

    Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2018-14671

    In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 8.8

    HIGH
    CVE-2018-14668

    In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 5.3

    MEDIUM
    CVE-2019-18657

    ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Oct. 31, 2019
    • Modified: Jun. 25, 2025

  • 7.5

    HIGH
    CVE-2018-14669

    ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 5.3

    MEDIUM
    CVE-2018-14672

    In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.... Read more

    Affected Products : clickhouse clickhouse
    • Published: Aug. 15, 2019
    • Modified: Jun. 25, 2025

  • 9.8

    CRITICAL
    CVE-2025-26909

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through 5.4.01.... Read more

    Affected Products : hide_my_wp_ghost
    • Published: Mar. 27, 2025
    • Modified: Jun. 25, 2025
    • Vuln Type: Path Traversal

  • 4.8

    MEDIUM
    CVE-2024-11847

    The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.... Read more

    Affected Products : _wp_svg_upload
    • Published: Mar. 26, 2025
    • Modified: Jun. 25, 2025
    • Vuln Type: Cross-Site Scripting

  • 7.5

    HIGH
    CVE-2025-5729

    A vulnerability, which was classified as critical, was found in code-projects Health Center Patient Record Management System 1.0. Affected is an unknown function of the file /birthing_record.php. The manipulation of the argument itr_no leads to sql inject... Read more

    Affected Products : patient_record_management_system
    • Published: Jun. 06, 2025
    • Modified: Jun. 25, 2025
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-5881

    A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirm_password.php. The manipulation of the argument cid leads to sql injection. The attack may be ... Read more

    Affected Products : chat_system chat_system
    • Published: Jun. 09, 2025
    • Modified: Jun. 25, 2025
    • Vuln Type: Injection

  • 5.4

    MEDIUM
    CVE-2025-45055

    Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript ... Read more

    Affected Products : silverpeas
    • Published: Jun. 09, 2025
    • Modified: Jun. 25, 2025
    • Vuln Type: Cross-Site Scripting
Showing 20 of 294513 Results