Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 330new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2025-25181 Exploited |
Not yet scored | Advantive VeraCore Applications & supply chain |
Advantive VeraCore SQL Injection Vulnerability | 10 Mar 2025 |
| CVE-2023-34192 Exploited |
Not yet scored | Synacor Zimbra Collaboration Suite (ZCS) Applications & supply chain |
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 25 Feb 2025 |
| CVE-2017-3066 Exploited |
Not yet scored | Adobe ColdFusion Applications & supply chain |
Adobe ColdFusion Deserialization Vulnerability | 24 Feb 2025 |
| CVE-2022-23748 Exploited |
Not yet scored | Audinate Dante Discovery Applications & supply chain |
Dante Discovery Process Control Vulnerability | 6 Feb 2025 |
| CVE-2020-29574 Exploited |
Not yet scored | Sophos CyberoamOS Applications & supply chain |
CyberoamOS (CROS) SQL Injection Vulnerability | 6 Feb 2025 |
| CVE-2020-11023 Exploited |
Not yet scored | JQuery JQuery Applications & supply chain |
JQuery Cross-Site Scripting (XSS) Vulnerability | 23 Jan 2025 |
| CVE-2024-11680 Exploited |
Not yet scored | ProjectSend ProjectSend Applications & supply chain |
ProjectSend Improper Authentication Vulnerability | 3 Dec 2024 |
| CVE-2024-44309 Exploited |
Not yet scored | Apple Multiple Products Applications & supply chain |
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | 21 Nov 2024 |
| CVE-2021-41277 Exploited |
Not yet scored | Metabase Metabase Applications & supply chain |
Metabase GeoJSON API Local File Inclusion Vulnerability | 12 Nov 2024 |
| CVE-2024-37383 Exploited |
Not yet scored | Roundcube Webmail Applications & supply chain |
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 24 Oct 2024 |
| CVE-2022-21445 Exploited |
Not yet scored | Oracle ADF Faces Applications & supply chain |
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | 18 Sep 2024 |
| CVE-2024-6670 Exploited |
Not yet scored | Progress WhatsUp Gold Applications & supply chain |
Progress WhatsUp Gold SQL Injection Vulnerability | 16 Sep 2024 |
| CVE-2024-7262 Exploited |
Not yet scored | Kingsoft WPS Office Applications & supply chain |
Kingsoft WPS Office Path Traversal Vulnerability | 3 Sep 2024 |
| CVE-2022-0185 Exploited |
Not yet scored | Linux Kernel Applications & supply chain |
Linux Kernel Heap-Based Buffer Overflow Vulnerability | 21 Aug 2024 |
| CVE-2024-38107 Exploited |
Not yet scored | Microsoft Windows Applications & supply chain |
Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability | 13 Aug 2024 |
| CVE-2024-39891 Exploited |
Not yet scored | Twilio Authy Applications & supply chain |
Twilio Authy Information Disclosure Vulnerability | 23 Jul 2024 |
| CVE-2024-34102 Exploited |
Not yet scored | Adobe Commerce and Magento Open Source Applications & supply chain |
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 17 Jul 2024 |
| CVE-2020-13965 Exploited |
Not yet scored | Roundcube Webmail Applications & supply chain |
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 26 Jun 2024 |
| CVE-2024-4577 Exploited |
Not yet scored | PHP Group PHP Applications & supply chain |
PHP-CGI OS Command Injection Vulnerability | 12 Jun 2024 |
| CVE-2024-30051 Exploited |
Not yet scored | Microsoft DWM Core Library Applications & supply chain |
Microsoft DWM Core Library Privilege Escalation Vulnerability | 14 May 2024 |
| CVE-2023-43770 Exploited |
Not yet scored | Roundcube Webmail Applications & supply chain |
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 12 Feb 2024 |
| CVE-2023-7024 Exploited |
Not yet scored | Google Chromium WebRTC Applications & supply chain |
Google Chromium WebRTC Heap Buffer Overflow Vulnerability | 2 Jan 2024 |
| CVE-2023-49103 Exploited |
Not yet scored | ownCloud ownCloud graphapi Applications & supply chain |
ownCloud graphapi Information Disclosure Vulnerability | 30 Nov 2023 |
| CVE-2023-4911 Exploited |
Not yet scored | GNU GNU C Library Applications & supply chain |
GNU C Library Buffer Overflow Vulnerability | 21 Nov 2023 |
| CVE-2023-36033 Exploited |
Not yet scored | Microsoft Windows Applications & supply chain |
Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | 14 Nov 2023 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.