106,755 results · Clear filters · Feed
-
Medium 5.5
The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the w…
-
Medium 6.5
The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received…
-
Medium 4.3
bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _…
-
Medium 5.4
Chargemap stored XSS
Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forg…
-
Medium 5.4CVE-2026-67176 Public exploit
Chargemap open redirect
Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a crafted URL to a victim and redirect them to an attacker controlled domain. Fixed 2026-07-17.
-
Medium 4.6CVE-2026-67175 Public exploit
Chargemap stored XSS
Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser whe…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of …
-
Medium 5.4
Adobe Experience Manager | Improper Input Validation (CWE-20)
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited read and w…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of …
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of …
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of …
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser whe…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of …
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser whe…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the conte…
-
Medium 6.5
BeeS ERP administrative console IDOR
BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and stud…
-
Medium 6.3
The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator…
-
Medium 5.9
Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to byp…
-
Medium 5.9
Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to…
-
Medium 4.0
Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with admi…
-
Medium 5.9
Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervis…
-
Medium 4.0
A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware co…
-
Medium 5.9
Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware coul…
-
Medium 4.0
Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allo…
-
Medium 5.9
Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacke…
-
Medium 5.9
Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buf…
-
Medium 5.9
Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to…
-
Medium 4.3
Active Storage: Possible DoS vulnerability in Active Storage filename handling
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored…
-
Medium 5.4
Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attack…
-
Medium 5.4
Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convin…
-
Medium 6.1
Product Filter for WooCommerce by WBW <= 3.4.5 - Reflected Cross-Site Scripting via 'text_no_products' Parameter
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This ma…
-
Medium 4.7
Active Support: Possible XSS vulnerability in Active Support MessagePack serializer
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new…
-
Medium 4.8
Action Pack: Possible cache poisoning in Action Pack content negotiation
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers…
-
Medium 5.3
Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_…
-
Medium 5.5
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could res…
-
Medium 6.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featu…
-
Medium 5.9
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featu…
-
Medium 6.5
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to applicatio…
-
Medium 5.1
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security…