Free CVE feed
The latest CVEs, and which ones attackers already use
Every Critical and High CVE NVD published in the last 7 days, what CISA added to its Known Exploited Vulnerabilities catalog in the last 30, and the EPSS odds of each being exploited. No account, no email.
The short answer
In the last 7 days NVD published 38 Critical and 242 High CVEs. In the last 30 days CISA confirmed 40 vulnerabilities as exploited in the wild by adding them to its Known Exploited Vulnerabilities catalog. Patch what is in KEV first, then high EPSS, then high CVSS.
- Critical, 7 days
- 38
- High, 7 days
- 242
- Added to KEV, 30 days
- 40
- In the KEV catalog
- 1,779
Newly exploited vulnerabilities, every Monday
What CISA added to its KEV catalog that week, and the Critical CVEs most likely to be exploited. One email a week, one click to stop.
Updated from NVD, CISA KEV and FIRST EPSS. Also as markdown and RSS.
Latest Critical and High CVEs
padloc · padloc
Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared…
SemanticMediaWiki · SemanticMediaWiki
Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit…
SemanticMediaWiki · SemanticMediaWiki
Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the…
WWBN · AVideo
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen…
WWBN · AVideo
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or…
WWBN · AVideo
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php…
directus · directus
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or…
jellyfin · jellyfin
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup…
LibreCAD · LibreCAD
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap…
XTemos · Basel Post Types
The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than…
Adobe · Adobe Connect
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially…
Adobe · Adobe Connect
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially…
Adobe · Adobe Connect
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue…
Adobe · Adobe Connect
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.
Adobe · Adobe Connect
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not…
Adobe · Audition
Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file…
Adobe · Premiere
Premiere Pro is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is…
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check…
Microsoft · Microsoft SQL Server 2022 (GDR)
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.
Microsoft · Windows 10 Version 1809
Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.
Microsoft · Microsoft SharePoint Server Subscription Edition
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft · Azure DevOps Server
Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
Microsoft · Microsoft SQL Server 2017 (GDR)
Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network.
Microsoft · Microsoft SharePoint Server Subscription Edition
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft · Windows Server 2016
Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.
Microsoft · Microsoft JDBC Driver for SQL Server 13.4
Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network.
Microsoft · Windows 10 Version 1607
Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network.
Microsoft · Windows 10 Version 1607
Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.
Microsoft · Windows 10 Version 1607
Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
Microsoft · Windows 10 Version 1607
Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Microsoft · Azure Confidential Clean Room
Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.
Microsoft · Visual Studio Code
Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Microsoft · Visual Studio Code
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Microsoft · Visual Studio Code
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Microsoft · Visual Studio Code
Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Microsoft · Visual Studio Code
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Microsoft · Aspire.Cli
Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.
Microsoft · Microsoft 365 Apps for Enterprise
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Microsoft · Microsoft 365 Apps for Enterprise
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft · Microsoft SharePoint Server Subscription Edition
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft · Microsoft 365 Apps for Enterprise
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Microsoft · Microsoft SharePoint Server Subscription Edition
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft · Microsoft 365 Apps for Enterprise
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
Microsoft · Microsoft 365 Apps for Enterprise
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft · Microsoft 365 Apps for Enterprise
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
Microsoft · Azure Web Apps
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.
Microsoft · Windows 10 Version 21H2
Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
Microsoft · Microsoft 365 Apps for Enterprise
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Microsoft · Visual Studio Code
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Microsoft · Visual Studio Code
Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Microsoft · Visual Studio Code
Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.
Microsoft · Visual Studio Code
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1809
Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 11 version 23H2
Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 11 Version 24H2
Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Microsoft · Windows Server 2016
Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1809
Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.
Microsoft · Windows Server 2016
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.
Microsoft · Windows 10 Version 1607
Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 21H2
Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network.
Microsoft · Windows 11 Version 24H2
Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.
Microsoft · Windows 10 Version 1607
Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1809
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1809
Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1809
Heap-based buffer overflow in Windows Input System allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 11 version 23H2
Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.
Microsoft · Windows 10 Version 1607
Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to elevate privileges locally.
Microsoft · Windows Sandbox
Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1809
Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
Microsoft · Windows 10 Version 1607
Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.
NangoHQ · nango
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY…
aptabase · aptabase
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate…
Dolibarr · dolibarr
Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call…
firekylin · Firekylin
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users'…
mackron · dr_libs
A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
vlang · v
V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes…
Red Hat · Red Hat Edge Manager 1
A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections.
TÜBİTAK BİLGEM Software Technologies Research Institute · pardus-nvidia-installer
Permissive list of allowed inputs vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer allows Privilege Escalation. This issue affects pardus-nvidia-installer: before 2.0.1.
Red Hat · Red Hat Enterprise Linux 6
A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue…
TÜBİTAK BİLGEM Software Technologies Research Institute · eta-remote
Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3.
Siemens · SIMATIC WinCC V7.5
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected devices implicitly execute active content when opening files. This could allow an attacker to make the user execute arbitrary code on the device.
7-Zip · 7-Zip
7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling…
Siemens · ROS#
A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program.
MB connect line · mbCONNECT24
The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality.
MB connect line · mbCONNECT24
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
MB connect line · mbCONNECT24
An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability.
MB connect line · mbCONNECT24
A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
MB connect line · mbCONNECT24
A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
SAP_SE · SAP Cloud SDK for Python
The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp)…
SAP_SE · SAP Cloud SDK for AI(JavaScript)
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only…
armember · ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output…
WPML · WPML Multilingual CMS
The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the…
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated…
SAP_SE · SAP NetWeaver AS Java EDM Application
SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and…
SAP_SE · SAP NetWeaver and ABAP Platform (SAP Message Server)
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections…
SAP_SE · SAP NetWeaver and ABAP Platform
Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could…
Michael-A-Kuykendall · Shimmy
A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is…
D-Link · M60
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Ettercap · ettercap
Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer…
Ettercap · ettercap
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.
Ettercap · ettercap
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or…
Ettercap · ettercap
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the…
CoreBunch · Instatic
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to…
nocobase · nocobase
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI…
go2ismail · Asp.Net-Core-Inventory-Order-Management-System
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator…
RamonSilva20 · mapos
Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign…
kubero-dev · kubero
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which…
rehan-remade · universal-modder
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the…
SourceCodester · Smart Attendance System with QR Code Scanner
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the…
SourceCodester · Smart Attendance System with QR Code Scanner
A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out…
replicate · cog
Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE…
Red Hat · Red Hat Fuse 7
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt…
FFmpeg · FFmpeg
FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because check_pixel_ptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to the dvbsub encoder, writes past the output buffer and…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, because encode_init() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPOSE_OP_BACKGROUND memset writes past prev_frame and crashing…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and…
FFmpeg · FFmpeg
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated…
FFmpeg · FFmpeg
FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in libavcodec/vulkan_av1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than 256 tiles decoded via the Vulkan hardware accelerator to…
FFmpeg · FFmpeg
FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI_BRUN chunk whose non-terminating byte-swap loop writes…
nasa-jpl · ION-DTN
NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the…
nasa-jpl · ION-DTN
NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded…
Red Hat · Red Hat Enterprise Linux 10
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements…
Red Hat · Red Hat Enterprise Linux 10
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute…
Red Hat · Red Hat Enterprise Linux 10
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in…
HAVELSAN Inc. · Liman Render Engine
Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81.
Osbil Technology Ltd.Osbil Technology Ltd. · oPanel
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66.
C-Prot Inc. · C-Prot AppDefense
Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729.
rConfig · rConfig Core
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected…
Red Hat · Red Hat Enterprise Linux 10
A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated…
Red Hat · Red Hat Enterprise Linux 10
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest…
Chengdu Feiyuxing Technology · VW2100
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be…
Chengdu Feiyuxing Technology · VW2100
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be…
aaPanel · BillionMail
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection. The attack may be performed from remote. The…
Intelbras · SG 2404 PoE L2+
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made…
n/a · BeikeShop
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be…
D-Link · DIR-878
A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and…
D-Link · DIR-878
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could…
DataLinkDC · Dinky
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely…
n/a · JeecgBoot
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been…
Tidelift · moto
A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is possible. The exploit has…
IBM · webMethods Integration Server
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
IBM · DataStage on Cloud Pak for Data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
JiHong88 · suneditor
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a…
openemr · openemr
OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters to view payment pages and record fraudulent payment receipts…
openemr · openemr
OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token…
openemr · openemr
OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents…
openemr · openemr
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET…
openemr · openemr
OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL…
openemr · openemr
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF…
openemr · openemr
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or…
openemr · openemr
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted…
openemr · openemr
OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of '<module>/Controller.php', and the fax module's faxProcessUploads writes attacker-named files to a predictable temp path without extension checks…
openemr · openemr
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of…
openemr · openemr
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other…
openemr · openemr
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the setting_patient parameter in a JSON POST request to another patient's PID, altering that patient's portal…
openemr · openemr
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote…
openemr · openemr
OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve…
openemr · openemr
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or…
kyverno · kyverno
Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged…
scriban · scriban
Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting…
scriban · scriban
Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers…
getgrav · grav
Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes…
craftcms · cms
Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed…
How to read this feed
CVSS is the severity score NVD or the reporting vendor gave the vulnerability, from 0 to 10. Critical is 9.0 and above, High is 7.0 to 8.9. It says how bad an exploit would be, not how likely one is.
EPSS is FIRST's Exploit Prediction Scoring System: the probability, from 0 to 100%, that the vulnerability is exploited in the next 30 days. Most CVEs score under 1%, so anything above 10% stands out.
KEV is CISA's Known Exploited Vulnerabilities catalog: vulnerabilities with confirmed exploitation in the wild. U.S. federal agencies must patch them by the due date shown; everyone else should treat that date as a ceiling.
Is one of these in your dependencies?
A list like this tells you what was published, not what you ship. ZeusQA's vulnerability watch reads the manifests of a connected GitHub repository every day, checks each package version against OSV.dev and KEV, writes a plain briefing per advisory and opens the upgrade as a pull request.
Questions
Where does this CVE list come from?
Three public sources, merged per CVE. NVD supplies the CVE records published in the last 7 days with a CVSS v3 severity of Critical or High. CISA's Known Exploited Vulnerabilities catalog says which ones attackers are already using. FIRST's EPSS gives the probability each one is exploited in the next 30 days.
How often is it updated?
The feed is fetched again every 30 minutes. NVD often publishes a CVE before it has a score, so a CVE can appear here a few hours or days after its CVE ID was reserved, once it has a Critical or High rating.
What is the difference between CVSS, EPSS and KEV?
CVSS rates how bad a vulnerability would be if exploited, from 0 to 10. EPSS estimates how likely it is to be exploited in the next 30 days, from 0 to 100%. KEV is CISA's list of vulnerabilities with confirmed exploitation in the wild. Patch what is in KEV first, then high EPSS, then high CVSS.
How do I know whether one of these affects my code?
Match the vendor and product against what you run. For open-source dependencies, ZeusQA's vulnerability watch does it for you: it reads the manifests of a connected GitHub repository daily, checks every package version against OSV.dev and KEV, and opens the fix as a pull request.
Is this feed free to use?
Yes. The page, and the same data as markdown at /cves.md, are free with no account. The underlying records keep their sources' terms: NVD and KEV are U.S. government works, EPSS is published by FIRST.
Related
Vulnerability watch
Advisories in your own dependencies, with a fix pull request.
Exploited vulnerabilities by vendor
Every vendor in CISA's KEV catalog, ranked, with each one's full list.
The supermarket shelves went empty
The vulnerability was already published. What teams can learn.
More free tools
Viewport reference, selector checker and a test prompt builder.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.