[UNKNOWN] vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-53901 WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes.High 7.1 · Dec 16, 2025
• CVE-2025-66571 UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed Critical 9.3 · Dec 4, 2025
• CVE-2023-2713 Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows AuthenticaCritical 9.8 · May 20, 2023
• CVE-2023-2712 Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command InjCritical 9.8 · May 20, 2023
• CVE-2020-10736 An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, High 8 · Jun 22, 2020
• CVE-2019-14894 A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS scheHigh 8 · Jun 22, 2020
• CVE-2020-10738 A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions.High 7.5 · May 21, 2020
• CVE-2020-10725 A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on thHigh 7.7 · May 20, 2020
• CVE-2020-1712 A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages.High 7.8 · Mar 31, 2020
• CVE-2019-14880 A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier.Critical 9.1 · Mar 31, 2020
• CVE-2020-1709 A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was fouHigh 7 · Mar 20, 2020
• CVE-2020-1707 A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file waHigh 7 · Mar 20, 2020
• CVE-2019-19345 A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file wasHigh 7 · Mar 20, 2020
• CVE-2019-14842 Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks.Critical 9.8 · Nov 26, 2019
• CVE-2019-14853 An error-handling flaw was found in python-ecdsa before version 0.13.3.High 7.5 · Nov 26, 2019
• CVE-2019-14890 A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSHigh 8.4 · Nov 26, 2019
• CVE-2019-10174 A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke privatHigh 8.8 · Nov 25, 2019
• CVE-2019-10147 rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`.High 7.7 · Jun 3, 2019
• CVE-2019-10145 rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`.High 7.7 · Jun 3, 2019
• CVE-2019-10144 rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`.High 7.7 · Jun 3, 2019
• CVE-2019-8956 In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flHigh 7.8 · Apr 1, 2019
• CVE-2019-3821 A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled.High 7.5 · Mar 27, 2019
• CVE-2019-3849 A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8.High 8.8 · Mar 26, 2019
• CVE-2019-3830 A vulnerability was found in ceilometer before version 12.0.0.0rc1.High 7.8 · Mar 26, 2019
• CVE-2019-3804 It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack.High 7.5 · Mar 26, 2019