146229+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. …
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in …
The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due …
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin …
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system …
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder …
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device …
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide …
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory …
Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.
Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.
Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3.
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a …
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in …
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require …
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage …
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage …
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is …
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.20 CR, before LTSR 2607, and …
Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR 2607 Hotfix 1, and …
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type …
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 …
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any …
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability …
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability …
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML …
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML …
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the …
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a …
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network …
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to …
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. …
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code …
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to …
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML …
Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a …
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted …
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox …
Free website and port scanning — find vulnerabilities before attackers do.