Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,693
- Last 24h
- 433
- Critical, 7 days
- 344
- Known exploited
- 1,779
12,751 results · Clear filters · Feed
-
Low 3.3
mruby nregs codegen.c scope_new heap-based overflow
A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow…
-
Low 2.4
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the …
-
Low 3.5
Windows Storage Spoofing Vulnerability
External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.
-
Low 3.3
Office Developer Platform Security Feature Bypass Vulnerability
Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature locally.
-
Low 3.1
Microsoft Teams Elevation of Privilege Vulnerability
Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
-
Low 3.8
A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers spec…
-
Low 3.8
A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a r…
-
Low 2.6
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Forti…
-
Low 3.5
Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java
The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS s…
-
Low 2.7
Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application)
SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected res…
-
Low 3.5
CodeAstro Simple Hospital Management System POST Parameter doctor.html cross site scripting
A vulnerability classified as problematic was found in CodeAstro Simple Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor.html of the component POST Parameter Handler. The manipulation of the argume…
-
Low 3.5
CodeAstro Simple Hospital Management System POST Parameter patient.html cross site scripting
A vulnerability was found in CodeAstro Simple Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /patient.html of the component POST Parameter Handler. The manipulation leads to cross…
-
Low 2.4
SourceCodester Best Salon Management System Admin Profile Page admin-profile.php cross site scripting
A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /panel/admin-profile.php of the component Admin Profile Page. The manipulation of the argument…
-
Low 2.4
SourceCodester Best Salon Management System Update Tax Page edit-tax.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/edit-tax.php of the component Update Tax Page. The manipulation of the argument Tax Name leads …
-
Low 2.4
SourceCodester Best Salon Management System search-appointment.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/search-appointment.php. The manipulation leads to cross site scrip…
-
Low 2.4
SourceCodester Best Salon Management System Update Staff Page edit_plan.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /panel/edit_plan.php of the component Update Staff Page. The manipulation leads to c…
-
Low 2.4
SourceCodester Best Salon Management System Update Staff Page edit-staff.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit-staff.php of the component Update Staff Page. The manipulation of the argument Staff Name lead…
-
Low 2.4
SourceCodester Best Salon Management System Update Customer Details Page edit-customer-detailed.php cross site scripting
A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /panel/edit-customer-detailed.php of the component Update Customer Details Page. The manipul…
-
Low 3.1
Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster [splunk.secret](https://help.splunk.com/en/spl…
-
Low 2.1
Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/ve…
-
Low 2.0
WeGIA allows Stored XSS attacks in novo_memorando.php
WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the inje…
-
Low 2.0
WebGia allows Cross-Site Scripting (XSS) in profile_familiar.php via the id_dependente parameter
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_de…
-
Low 2.0
WebGia allows Cross-Site Scripting (XSS) in cadastro_dependente_pessoa_nova.php via the id_funcionario parameter
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scrip…
-
Low 1.3
Dokploy Improperly Discloses User Information via user.one Endpoint
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization…
-
Low 3.5
Improper Input Validation in huggingface/transformers
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL u…
-
Low 3.5
Portabilis i-Educar Curricular Components Module edit cross site scripting
A vulnerability was found in Portabilis i-Educar 2.9.0. It has been classified as problematic. Affected is an unknown function of the file /module/ComponenteCurricular/edit?id=ID of the component Curricular Components Module. The manipulation of the argument …
-
Low 3.5
Portabilis i-Educar Function Management Module educar_funcao_det.php cross site scripting
A vulnerability was found in Portabilis i-Educar 2.9.0 and classified as problematic. This issue affects some unknown processing of the file /intranet/educar_funcao_det.php?cod_funcao=COD&ref_cod_instituicao=COD of the component Function Management Module. Th…
-
Low 3.5
Portabilis i-Educar Course Module educar_curso_det.php cross site scripting
A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic. This vulnerability affects unknown code of the file /intranet/educar_curso_det.php?cod_curso=ID of the component Course Module. The manipulation of the argument Curso l…
-
Low 3.5
Portabilis i-Educar School Module educar_escola_lst.php cross site scripting
A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0. This affects an unknown part of the file /intranet/educar_escola_lst.php of the component School Module. The manipulation of the argument Escola leads to cross site …
-
Low 3.5
Portabilis i-Educar Student Benefits Registration educar_aluno_beneficio_lst.php cross site scripting
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file /intranet/educar_aluno_beneficio_lst.php of the component Student Benefits Registration. The ma…
-
Low 3.9
Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability ma…
-
Low 3.3
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerabi…
-
Low 3.7
Comodo Internet Security Premium Update certificate validation
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the atta…
-
Low 3.7
Done-0 Jank JWT Token jwt_utils.go hard-coded password
A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17. Affected is an unknown function of the file internal/utils/jwt_utils.go of the component JWT Token Handler. The manipulation of the …
-
Low 3.7
mao888 bluebell-plus JWT Token jwt.go hard-coded password
A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argume…
-
Low 3.3
HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflow
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FS__sect_link_size of the file src/H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local…
-
Low 3.3
HDF5 H5FL.c H5FL__malloc memory leak
A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5FL__malloc of the file src/H5FL.c. The manipulation leads to memory leak. Attacking locally is a requirement. The exploit has been disclosed…
-
Low 3.3
HDF5 H5FScache.c H5FS__sinfo_serialize_node_cb heap-based overflow
A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5FS__sinfo_serialize_node_cb of the file src/H5FScache.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach t…
-
Low 2.7
Intelbras InControl operador csv injection
A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/operador/. The manipulation leads to csv injection. The attack can be initiated remotely. The exploi…
-
Low 3.5
Cockpit save cross site scripting
A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initia…