Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,356
- Last 24h
- 650
- Critical, 7 days
- 338
- Known exploited
- 1,779
97,596 results · Clear filters · Feed
-
High 8.4
Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.
-
High 8.4
Arbitrary Code Execution in Qiskit SDK QPY Deserialization
IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.
-
High 8.8
Security Vulnerability identified in IBM TRIRIGA - Command Execution
IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
-
High 7.7
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.
-
High 8.1
IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.
-
High 8.5
WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
-
High 7.1
WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.
-
High 7.5
BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing
BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares …
-
High 7.3
Jinher OA ProjectAfficheManage.aspx sql injection
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack …
-
High 8.3
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList,…
-
High 7.1
OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privil…
-
High 8.6
OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-s…
-
High 8.8
OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a …
-
High 7.1
OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allo…
-
High 8.3
OpenEMR before 8.4.0 Improper Authorization via Prescription REST API
OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Aut…
-
High 8.7
OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any auth…
-
High 8.7
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to r…
-
High 7.1
OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts…
-
High 7.1
OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-su…
-
High 8.7
OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to d…
-
High 7.1
OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or ove…
-
High 8.6
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that a…
-
High 7.1
OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API
OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes pe…
-
High 8.6
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows…
-
High 7.1
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer se…
-
High 7.2
OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri
OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token i…
-
High 8.7
OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the u…
-
High 7.1
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() th…
-
High 8.1
OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint
OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fe…
-
High 8.6
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save en…
-
High 7.1
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allow…
-
High 7.1
OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module
OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can requ…
-
High 7.6
OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname
OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences…
-
High 7.1
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() th…
-
High 7.1
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows a…
-
High 7.1
OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read …
-
High 7.6
OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into prev…
-
High 8.1
OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the on…
-
High 8.7
OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient di…
-
High 7.1
OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal use…