Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,809
- Last 24h
- 355
- Critical, 7 days
- 341
- Known exploited
- 1,779
12,768 results · Clear filters · Feed
-
Low 3.1
Improper Encoding or Escaping of Output in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to …
-
Low 2.6
Incorrect Provision of Specified Functionality in GitLab
Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."
-
Low 2.5
Enpass Password Manager sensitive information in memory
A vulnerability, which was classified as problematic, has been found in Enpass Password Manager up to 6.9.5 on Windows. This issue affects some unknown processing. The manipulation leads to cleartext storage of sensitive information in memory. An attack has t…
-
Low 3.1
DoS via non-string message using permalink embed
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
-
Low 3.1
Weak SSRF Filtering
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
-
Low 3.1
Unauthorized access on archived channels via file links
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.
-
Low 2.7
Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for au…
-
Low 3.3
BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web …
-
Low 3.8
TCC Bypass in Cursor's macOS Application
Cursor is an artificial intelligence code editor. Prior to version 0.41.0, if a user on macOS has granted Cursor access to the camera or microphone, any program that is run on the machine is able to access the camera or the microphone without explicitly being…
-
Low 3.7
IBM Aspera Console information disclosure
IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
-
Low 3.7CVE-2023-5359 Public exploit
W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext
The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to…
-
Low 3.5
SourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scripting
A vulnerability was found in SourceCodester Profile Registration without Reload Refresh 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file add.php of the component Registration Form. The manipulation of the…
-
Low 3.7
WordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in Peter Hardy-vanDoorn Maintenance Redirect jf3-maintenance-mode.This issue affects Maintenance Redirect: from n/a through <= 2.0.1.
-
Low 3.5
SourceCodester Modern Loan Management System update_loan_record.php cross site scripting
A vulnerability was found in SourceCodester Modern Loan Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file update_loan_record.php. The manipulation of the argument amount leads to cross site scripting. …
-
Low 3.5
code-projects Blood Bank System bbms.php cross site scripting
A vulnerability classified as problematic was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file bbms.php. The manipulation of the argument fullname/age/bloodgroup/city/phno/gender as part of String leads to cros…
-
Low 2.4
SourceCodester Employee Management System add-admin.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file /Admin/add-admin.php. The manipulation of the argument txtfullname leads to cross site scripting. It is possibl…
-
Low 3.5
dingfangzu Order Checkout order.js cross site scripting
A vulnerability classified as problematic has been found in dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected is an unknown function of the file scripts/order.js of the component Order Checkout. The manipulation of the argument address-name …
-
Low 2.6
Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting
A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. It has been declared as problematic. This vulnerability affects unknown code of the component Markdown-to-PDF. The manipulation leads to cross site scripting. The attack can be initiated r…
-
Low 3.1
y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting
A vulnerability was found in y_project RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImpl of the file ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java of th…
-
Low 3.8
Qemu-kvm: information leak in virtio devices
A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has…
-
Low 2.3
code-projects Blood Bank Management System Password cleartext storage in a file or on disk
A vulnerability, which was classified as problematic, was found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the component Password Handler. The manipulation leads to cleartext storage in a file or on disk. An attack has …
-
Low 3.5
SourceCodester Best House Rental Management System ajax.php cross site scripting
A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_category. The manipulation of the argument nam…
-
Low 3.5
CodeCanyon CRMGo SaaS show cross site scripting
A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2. This issue affects some unknown processing of the file /project/task/{task_id}/show. The manipulation of the argument comment leads to cross site scriptin…
-
Low 3.5
CodeCanyon CRMGo SaaS note cross site scripting
A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remot…
-
Low 3.5CVE-2024-9007 Scanner template
jeanmarc77 123solar detailed.php cross site scripting
A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remote…
-
Low 2.9
Cross-site Scripting (XSS) - stored (edit form HTML field)
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
-
Low 3.7
Multiple caveats on resources of the same type can result in no permission when permission is expected
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when …
-
Low 3.5
SourceCodester Resort Reservation System manage_fee.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_fee.php. The manipulation of the argument toview leads to cross site scripting. …
-
Low 2.4
The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical ac…
-
Low 3.3
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15…
-
Low 2.4
The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical ac…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and…
-
Low 3.3
This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able…
-
Low 3.1
Authorization Bypass Through User-Controlled Key in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members.
-
Low —
lexical-core has multiple soundness issues
`RUSTSEC-2024-0377` contains multiple soundness issues: 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102) 1. [BytesIter::read() advances iterators out of bounds](https://git…
-
Low 2.5
Out-of-bounds read in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable deni…
-
Low 3.3
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable…
-
Low 3.5
Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potential…
-
Low 3.7
Silent Desktop Screenshot Capture
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.
-
Low 2.5
Insufficient Electron Fuses Configuration
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.