Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,626
- Last 24h
- 527
- Critical, 7 days
- 345
- Known exploited
- 1,779
12,741 results · Clear filters · Feed
-
Low 3.7
JhumanJ OpnForm HTTP Header excessive authentication
A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempt…
-
Low 2.4
JhumanJ OpnForm Form Editor forms cross site scripting
A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published a…
-
Low 3.5
itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting
A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php?action=reset of the component Query Parameter Handler. Performing a manipulation of the argument ID…
-
Low 2.4
projectworlds Advanced Library Management System edit_admin.php cross site scripting
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attac…
-
Low 3.5
code-projects Voting System candidates_edit.php cross site scripting
A flaw has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/candidates_edit.php. This manipulation of the argument Firstname/Lastname/Platform causes cross site scripting. Remote exploitation of the…
-
Low 3.3
Deno's --deny-read check does not prevent permission bypass
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats…
-
Low 3.3
Deno's --deny-write check does not prevent permission bypass
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to c…
-
Low 3.3
GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds
A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. Th…
-
Low 3.3
GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has …
-
Low 3.3
GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds
A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exp…
-
Low 2.3
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3…
-
Low 3.7
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3…
-
Low 1.0
Wasmtime has memory leak in C API with `externref` and `anyref` types
Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all pri…
-
Low 2.9
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations …
-
Low 2.1
Emlog vulnerable to stored XSS in file upload functionality in emlog
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authe…
-
Low 2.4
langleyfcu Online Banking System Add Customer customer_add_action.php cross site scripting
A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This impacts an unknown function of the file /customer_add_action.php of the component Add Customer Page. The manipulation of the argument First…
-
Low 3.5
CmsEasy URL view.php cross site scripting
A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing a manipulation of the argument PHP_SELF can lead to cross site scripting. The attack may be launche…
-
Low 2.7
Information Disclosure Through Stacktrace
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of the appl…
-
Low 3.8
Unlimited user creation by authorized users
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.
-
Low 3.7
Mangati NovoSGA User Creation new weak password
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password …
-
Low 2.2
The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can le…
-
Low 3.5
The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes.
-
Low 3.6
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a Pro…
-
Low 3.6CVE-2025-61984 Public exploit
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted source…
-
Low 3.5
Vanderlande Baggage 360 messages cross site scripting
A vulnerability was identified in Vanderlande Baggage 360 7.0.0. This issue affects some unknown processing of the file /api-addons/v1/messages. Such manipulation of the argument Message leads to cross site scripting. The attack may be performed from remote. …
-
Low 2.4
westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting
A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java of the component Template Managem…
-
Low 2.4
Frappe LMS Course cross site scripting
A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be executed remotely. The exploit has be…
-
Low 2.4
Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting
A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The ex…
-
Low 3.7
Frappe LMS Assignment Picture files direct request
A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation causes direct request. The attack may be initiated remotely. The attack's complexity is rated as hig…
-
Low 3.5
Rebuild Comment/Guestbook cross site scripting
A security flaw has been discovered in Rebuild up to 4.1.3. Affected by this issue is some unknown functionality of the component Comment/Guestbook. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. Upgra…
-
Low 3.3
Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resources
A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to lo…
-
Low 2.5
DataChain: Deserialization of Untrusted Data from Environment Variables
DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (…
-
Low 2.3
Claude Code: Permission deny bypass is possible through symlink
Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was po…
-
Low —
wrflib has a soundness issue and is unmaintained
All functions under `wrflib::byte_extract` are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter. `wrflib` is unmaintained.
-
Low 3.5
HCL MyXalytics is affected by the use of vulnerable/outdated versions
HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
-
Low 2.1
User information disclosure via api_jsonrpc.php on method user.get with param search
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.
-
Low 3.8
Backup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download
The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch() function. This makes it possible for authenticated attackers, with Administrat…
-
Low 1.8
Server-side request forgery in Secure Access
CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a crafted test HTTP request originating from the Secure Access server. The attack complexity is high, t…
-
Low 2.3
Job details are visible to all team members on KNIME Business Hub
Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all infor…
-
Low 2.1
Weblate integration with Anubis can lead to Open Redirect via redir parameter
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate dom…