Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,583
- Last 24h
- 565
- Critical, 7 days
- 342
- Known exploited
- 1,779
12,737 results · Clear filters · Feed
-
Low 2.4
SolarEdge SE3680H - Information Exposure during Bootloader Loop
SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initializes and waits for boot instructions, the bootloader emits diagnostic output this behavior can leak operating system infor…
-
Low 2.4
CleverDisplay BlueOne unauthorized BIOS access through physical USB keyboard
The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that, after cicumventing the device’s protective enclosure, it was possible to conne…
-
Low 3.5
WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery
The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_time_ajax_request' AJAX action. This makes it possible for authenticated attackers, with Subscriber-…
-
Low 3.1
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user …
-
Low 3.3
Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.
-
Low 3.5
yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting
A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCustomer of the file CustomerManageHandler.java. Such manipulation of the argument Name leads to cross site scripting. The attack can be execut…
-
Low 1.0
Potential non-constant time compiled code with Clang LLVM
Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimizations, which can potentially result in observable timing discrepancies and lead to information disclosure through timing si…
-
Low 3.8
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
-
Low 2.7
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
-
Low 3.1
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
-
Low 3.5
baowzh hfly advtext add cross site scripting
A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admin/index.php/advtext/add of the component advtext Module. The manipulation results in cross site scri…
-
Low 3.5
Improper Encoding or Escaping of Output in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by i…
-
Low 3.3
An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF…
-
Low 3.5
TableProgressTracking's missing CSRF protection allows unauthorized state changes
TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authe…
-
Low 1.9
Ubuntu Apport Insecure File Permissions Vulnerability
It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.
-
Low 3.5
Jenkins has a CSRF vulnerability on the login form
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
-
Low 3.5
XSS in TACAS Consulting's GoldenHorn
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TAC Information Services Internal and External Trade Inc. GoldenHorn allows Cross-Site Scripting (XSS). This issue affects GoldenHorn: before 4.25.112…
-
Low 2.7
Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure
A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.
-
Low 3.7
Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration
Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a give…
-
Low 2.4
Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs
Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensitive information in exported diagnostics, especially when access denied errors occurred.
-
Low 3.3
Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could levera…
-
Low 3.3
Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could levera…
-
Low 2.6
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all…
-
Low 2.6
A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticat…
-
Low 2.4
Improper input validation in NETGEAR Nighthawk router R7000P
An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router…
-
Low 2.7
WordPress Admin and Site Enhancements (ASE) plugin <= 8.0.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.0.8.
-
Low 2.7
WordPress Photo Block plugin <= 1.5.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ronald Huereca Photo Block photo-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Block: from n/a through <= 1.5.1.
-
Low 2.7
IBM QRadar SIEM is affected by an information disclosure vulnerability
IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed this vulnerability in the latest update.
-
Low 3.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications co…
-
Low 3.3
Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory. If exploited…
-
Low 1.3
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condit…
-
Low 2.7
IBM Controller Validation Bypass
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security.
-
Low 2.4
GreenCMS Menu Management CustomController.class.php cross site scripting
A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting…
-
Low 3.5
Yealink SIP-T21P E2 Local Directory cross site scripting
A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made a…
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.5CVE-2025-14221 Public exploit
SourceCodester Online Banking System page cross site scripting
A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be launched remotely. The…
-
Low 3.3
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The gen…