Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,013
- Last 24h
- 791
- Critical, 7 days
- 351
- Known exploited
- 1,779
12,708 results · Clear filters · Feed
-
Low 2.7
Tanium addressed an insufficient logging vulnerability in Tanium Server.
Tanium addressed an insufficient logging vulnerability in Tanium Server.
-
Low 3.6
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
-
Low 2.5
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
-
Low 3.3
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
-
Low 2.3
Asterisk: Possible RED T.140 Generation Accumulation OOB Write
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing rem…
-
Low 2.3
Asterisk: Possible RED T.140 Heap Buffer Overflow
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing As…
-
Low 3.3
systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the …
-
Low 3.5
A public shared collective always allowed recipients of the link to create pages.
-
Low 3.5
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or …
-
Low 3.3
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting use…
-
Low 2.3
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello (ECH). When the server rejects ECH, the client completes the handshake with the oute…
-
Low 3.7
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
## Summary The client records the server-selected key-exchange group per server name when it processes the ServerHello, before the server is authenticated. A network attacker can answer one connection attempt for a target name with a ServerHello that selects …
-
Low 3.7
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
### Summary The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator canno…
-
Low 2.3
Host filesystem path disclosure via DNS rebinding
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address…
-
Low 3.8
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through …
-
Low 1.9
Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This c…
-
Low 3.7
@fastify/session vulnerable to session revocation bypass via a logout race condition
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call,…
-
Low 3.5
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or i…
-
Low 2.3
Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to fal…
-
Low 3.1
Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
-
Low 3.7
TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook no…
-
Low 3.7
qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection
### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax …
-
Low 3.5
Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting
A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of t…
-
Low 3.5
MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scriptin…
-
Low 2.4
Argilla TextField.vue cross site scripting
A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. Th…
-
Low 2.4
Argilla Sandbox.vue cross site scripting
A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site …
-
Low 3.5
Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument…
-
Low 3.7
flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal …
-
Low 3.7
flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causi…
-
Low 3.3
libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plis…
-
Low 3.3
gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buf…
-
Low 3.3
gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buff…
-
Low 3.3
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27…
-
Low 3.3
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.…
-
Low 3.3
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia …
-
Low 3.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Low 3.3
This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2,…
-
Low 3.3
An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS…
-
Low 3.3
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia …
-
Low 3.3
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, …