Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,732
- Last 24h
- 378
- Critical, 7 days
- 341
- Known exploited
- 1,779
12,759 results · Clear filters · Feed
-
Low 3.5
NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft …
-
Low 3.5
In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking.
-
Low 3.7
ChurchCRM Referer server-side request forgery
A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched …
-
Low 3.5
GL.iNet GL-A1300 Slate Plus Download Interface improper authorization
A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT30…
-
Low 3.1
Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content
Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the l…
-
Low 2.9
markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption
python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consumption.
-
Low 3.1
Moodle: csrf token exposure via url in moodle mod_data module
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data …
-
Low 3.5
Moodle: csrf risk in moodle user tours manager allows tour duplication
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks.
-
Low 3.5CVE-2025-46618 EPSS 63%
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
-
Low 2.4
Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to …
-
Low 3.5
In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This…
-
Low 3.2
HCL Leap is affected by missing "no cache" headers
Missing "no cache" headers in HCL Leap permits user directory information to be cached.
-
Low 3.2
HCL Leap is affected by missing "no cache" headers
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
-
Low 3.7
HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.
-
Low 3.1
Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions crea…
-
Low 3.7
IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using man in the middle techniques.
-
Low 2.5
In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI …
-
Low 3.2
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal es…
-
Low 2.9
In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the render…
-
Low 2.9
In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.
-
Low 2.5
NVIDIA NvContainer service for Windows contains a vulnerability in its usage of OpenSSL, where an attacker could exploi…
-
Low 3.7
YXJ2018 SpringBoot-Vue-OnlineExam API improper authentication
A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This issue affects some unknown processing of the component API. The manipulation leads to improper authentication. The attack may be initiated remo…
-
Low 3.8
IBM Maximo Asset Management server-side request forgery
IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
-
Low 3.3
wix-incubator jam Jinja2 Template jam.py special elements used in a template engine
A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown part of the file jam.py of the component Jinja2 Template Handler. The manipulation of the argument con…
-
Low 2.3
Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager
Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.
-
Low 2.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of …
-
Low 3.8
Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla
A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend.
-
Low 2.5
In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled.
-
Low 3.4
Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing us…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-supplier.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part of the file add-supplier.php. The manipulation of the argument txtsupplier_name/txtaddress leads t…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-category.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this issue is some unknown functionality of the file add-category.php. The manipulation of the argument txtcat…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-product.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unknown functionality of the file add-product.php. The manipulation of the argument txtprice/txtproduc…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-stock.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file add-stock.php. The manipulation of the argument txttotalcost/txtproductID/txtprice/txtexpi…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System changepassword.php cross site scripting
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file changepassword.php. The manipulation of the argument txtconfirm_password/txt…
-
Low 2.4
SourceCodester Web-based Pharmacy Product Management System add-admin.php cross site scripting
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file add-admin.php. The manipulation of the argument txtpassword/txtfullname/txte…
-
Low 2.9
In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimu…
-
Low 2.9
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processin…
-
Low 2.9
libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a gr…
-
Low 2.2
TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow exp…
-
Low 2.9
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col a…