| CVE-2024-48248 Known exploited | High 8.6 | NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because… Assigned by mitre | Mar 4, 2025 |
| CVE-2025-24893 Known exploited | Critical 9.8 | Remote code execution as guest via SolrSearchMacros request in xwiki Assigned by GitHub_M | Feb 20, 2025 |
| CVE-2025-24989 Known exploited | High 8.2 | Microsoft Power Pages Elevation of Privilege Vulnerability Assigned by microsoft | Feb 19, 2025 |
| CVE-2025-0111 Known exploited | High 7.1 | PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface Assigned by palo_alto | Feb 12, 2025 |
| CVE-2025-0108 Known exploited | High 8.8 | PAN-OS: Authentication Bypass in the Management Web Interface Assigned by palo_alto | Feb 12, 2025 |
| CVE-2025-21418 Known exploited | High 7.8 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Assigned by microsoft | Feb 11, 2025 |
| CVE-2025-21391 Known exploited | High 7.1 | Windows Storage Elevation of Privilege Vulnerability Assigned by microsoft | Feb 11, 2025 |
| CVE-2025-24472 Known exploited | High 8.1 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote… Assigned by fortinet | Feb 11, 2025 |
| CVE-2025-24016 Known exploited | Critical 9.9 | Remote code execution in Wazuh server Assigned by GitHub_M | Feb 10, 2025 |
| CVE-2025-24200 Known exploited | Medium 6.1 | An authorization issue was addressed with improved state management. Assigned by apple | Feb 10, 2025 |
| CVE-2025-0994 Known exploited | High 8.6 | Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. Assigned by icscert | Feb 6, 2025 |
| CVE-2024-40891 Known exploited | High 8.8 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could… Assigned by Zyxel | Feb 4, 2025 |
| CVE-2024-40890 Known exploited | High 8.8 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an… Assigned by Zyxel | Feb 4, 2025 |
| CVE-2023-52163 Known exploited | High 8.8 | Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. Assigned by mitre | Feb 3, 2025 |
| CVE-2025-25181 Known exploited | Medium 5.8 | A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter. Assigned by mitre | Feb 3, 2025 |
| CVE-2024-57968 Known exploited | Critical 9.9 | Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). Assigned by mitre | Feb 3, 2025 |
| CVE-2025-24085 Known exploited | Critical 10.0 | A use after free issue was addressed with improved memory management. Assigned by apple | Jan 27, 2025 |
| CVE-2025-0411 Known exploited | High 7.0 | 7-Zip Mark-of-the-Web Bypass Vulnerability Assigned by zdi | Jan 25, 2025 |
| CVE-2025-23006 Known exploited | Critical 9.8 | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific condit… Assigned by sonicwall | Jan 23, 2025 |
| CVE-2025-23209 Known exploited | High 8.1 | Potential RCE with a compromised security key in craft/cms Assigned by GitHub_M | Jan 18, 2025 |
| CVE-2024-57728 Known exploited | High 7.2 | SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. Assigned by mitre | Jan 15, 2025 |
| CVE-2024-57727 Known exploited | Critical 9.1 | SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleH… Assigned by mitre | Jan 15, 2025 |
| CVE-2024-57726 Known exploited | Critical 9.9 | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. Assigned by mitre | Jan 15, 2025 |
| CVE-2025-21334 Known exploited | High 7.8 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability Assigned by microsoft | Jan 14, 2025 |
| CVE-2025-21333 Known exploited | High 7.8 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability Assigned by microsoft | Jan 14, 2025 |
| CVE-2025-21335 Known exploited | High 7.8 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability Assigned by microsoft | Jan 14, 2025 |
| CVE-2024-13159 Known exploited | Critical 9.8 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Assigned by ivanti | Jan 14, 2025 |
| CVE-2024-13160 Known exploited | Critical 9.8 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Assigned by ivanti | Jan 14, 2025 |
| CVE-2024-13161 Known exploited | Critical 9.8 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Assigned by ivanti | Jan 14, 2025 |
| CVE-2024-55591 Known exploited | Critical 9.6 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12… Assigned by fortinet | Jan 14, 2025 |
| CVE-2024-53704 Known exploited | High 8.2 | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. Assigned by sonicwall | Jan 9, 2025 |
| CVE-2025-0282 Known exploited | Critical 9.0 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remo… Assigned by ivanti | Jan 8, 2025 |
| CVE-2024-50603 Known exploited | Critical 10.0 | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Assigned by mitre | Jan 8, 2025 |
| CVE-2024-12987 Known exploited | High 7.3 | DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection Assigned by VulDB | Dec 27, 2024 |
| CVE-2024-53197 Known exploited | High 7.8 | ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Assigned by Linux | Dec 27, 2024 |
| CVE-2024-3393 Known exploited | High 8.7 | PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet Assigned by palo_alto | Dec 27, 2024 |
| CVE-2024-53150 Known exploited | High 7.1 | ALSA: usb-audio: Fix out of bounds reads when finding clock sources Assigned by Linux | Dec 24, 2024 |
| CVE-2024-56145 Known exploited | Critical 9.3 | RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms Assigned by GitHub_M | Dec 18, 2024 |
| CVE-2024-12686 Known exploited | Medium 6.6 | Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA) Assigned by BT | Dec 18, 2024 |
| CVE-2024-12356 Known exploited | Critical 9.8 | Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA) Assigned by BT | Dec 17, 2024 |
| CVE-2024-55956 Known exploited | Critical 9.8 | In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leve… Assigned by mitre | Dec 13, 2024 |
| CVE-2024-49138 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Dec 10, 2024 |
| CVE-2024-55550 Known exploited | Medium 4.4 | Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. Assigned by mitre | Dec 10, 2024 |
| CVE-2024-53104 Known exploited | High 7.8 | media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Assigned by Linux | Dec 2, 2024 |
| CVE-2024-11667 Known exploited | High 7.5 | A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) se… Assigned by Zyxel | Nov 27, 2024 |
| CVE-2024-49035 Known exploited | High 8.7 | Partner.Microsoft.Com Elevation of Privilege Vulnerability Assigned by microsoft | Nov 26, 2024 |
| CVE-2024-11680 Known exploited | Critical 9.8 | ProjectSend Unauthenticated Configuration Modification Assigned by VulnCheck | Nov 26, 2024 |
| CVE-2024-44309 Known exploited | Medium 6.3 | A cookie management issue was addressed with improved state management. Assigned by apple | Nov 19, 2024 |
| CVE-2024-44308 Known exploited | High 8.8 | The issue was addressed with improved checks. Assigned by apple | Nov 19, 2024 |
| CVE-2024-50302 Known exploited | Medium 5.5 | HID: core: zero-initialize the report buffer Assigned by Linux | Nov 19, 2024 |
