Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,693
- Last 24h
- 433
- Critical, 7 days
- 343
- Known exploited
- 1,779
12,751 results · Clear filters · Feed
-
Low 3.7
Next.js cache poisoning due to omission of Vary header
Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to retu…
-
Low 1.8
Incorrect Authorization vulnerability affects OpenText™ GroupWise
Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow unauthorized access to calendar items marked private. This issue affects GroupWise versions 7 t…
-
Low 3.8
The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited dur…
-
Low 3.8
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrato…
-
Low 3.7
Stored XSS in MintyDocs
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
-
Low 2.0
SOAP message input validation fault could in theory cause OAM service resource exhaustion
Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used for causing resource exhaustion in the Single RAN baseband OAM service. No practical exploit has be…
-
Low 3.3
The Nokia Single RAN baseband reveals its software version through the MNO internal RAN management network
The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST request through the Mobile Network Operator (MNO) internal RAN management network.
-
Low 3.1
Cross-site request forgery vulnerability exists in Active! mail 6 BuildInfo: 6.60.06008562 and earlier. If this vulnera…
-
Low 3.7
Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion
The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated a…
-
Low 3.3
Open5GS AMF Service amf-sm.c amf_state_operational assertion
A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amf_state_operational of the file src/amf/amf-sm.c of the component AMF Service. The manipulation leads to reachable assertion. It is …
-
Low 3.7
D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password
A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-c…
-
Low 3.7
D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy
A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation …
-
Low 3.1
File Browser's Password Protection of Links Vulnerable to Bypass
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potent…
-
Low 2.3
Host Header Injection (HHI) in the Hotspot Shield VPN client
Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use …
-
Low 2.8CVE-2025-32462 Public exploit
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, all…
-
Low 3.3
HDF5 H5Centry.c H5C__flush_single_entry null pointer dereference
A vulnerability was found in HDF5 1.14.6 and classified as problematic. Affected by this issue is the function H5C__flush_single_entry of the file src/H5Centry.c. The manipulation leads to null pointer dereference. The attack needs to be approached locally. T…
-
Low 3.3
HDF5 H5Gnode.c H5G__node_cmp3 stack-based overflow
A vulnerability has been found in HDF5 1.14.6 and classified as problematic. Affected by this vulnerability is the function H5G__node_cmp3 of the file src/H5Gnode.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on…
-
Low 3.3
HDF5 H5FL.c H5FL__reg_gc_list use after free
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FL__reg_gc_list of the file src/H5FL.c. The manipulation leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to …
-
Low 3.5
code-projects Simple Forum forum_edit1.php cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Simple Forum 1.0. Affected is an unknown function of the file /forum_edit1.php. The manipulation of the argument text leads to cross site scripting. It is possible to launch the …
-
Low 3.4
RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.
-
Low 3.3
Denial of Service via integer underflow in picserver
An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car wi…
-
Low 3.3
An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access t…
-
Low 3.3
HDF5 H5Ochunk.c H5O__chunk_protect heap-based overflow
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5O__chunk_protect of the file /src/H5Ochunk.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit …
-
Low 3.3
HDF5 H5Centry.c H5C__load_entry resource consumption
A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5C__load_entry of the file /src/H5Centry.c. The manipulation leads to resource consumption. The attack needs to be approached locally. The ex…
-
Low 3.3
HDF5 H5Ofsinfo.c H5O__fsinfo_encode heap-based overflow
A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local…
-
Low —
Taylor has race condition in /get-patch that allows purchase token replay
Hi team, I was looking at the recent fix and you limited the exploitability of race conditions but unfortunately it is still possible to exploit the issue since two requests happening at the exact same time will still go through. You should be able to complet…
-
Low 2.4
code-projects Food Distributor Site save_settings.php cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/save_settings.php. The manipulation of the argument site_phone/site_email/address leads to cross sit…
-
Low 3.0
Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs
Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HT…
-
Low 3.3
HDF5 H5Omtime.c H5O__mtime_new_encode heap-based overflow
A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. Affected by this issue is the function H5O__mtime_new_encode of the file src/H5Omtime.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirem…
-
Low 2.1
Bharti Airtel Thanks App files cleartext storage in a file or on disk
A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/data/com.myairtelapp/files/. The manipulation leads to cleartext storage in a file or on disk. It is …
-
Low 2.9
The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges …
-
Low 3.2
A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This …
-
Low 3.2
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow …
-
Low 3.2
The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writ…
-
Low 2.2
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.
-
Low 2.2
Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.
-
Low 2.0
Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.
-
Low 2.2
Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.
-
Low 2.0
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.
-
Low 3.9
pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.