Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,171
- Last 24h
- 698
- Critical, 7 days
- 364
- Known exploited
- 1,779
12,787 results · Clear filters · Feed
-
Low 3.3
Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure Vulnerability
Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro. User interaction is required to expl…
-
Low 3.3
PDF-XChange Editor TIF File Parsing Use-After-Free Information Disclosure Vulnerability
PDF-XChange Editor TIF File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this…
-
Low 3.9
LIEF obtain sensitive information via the name parameter
An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.
-
Low 2.6
CSRF in firebase-tools emulator suite
This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the…
-
Low 3.3
ZCC Mac validinstaller file integrity check missing
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4.
-
Low 2.7
Permission check bypass when editing a model with per-field restrictions in wagtail
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been us…
-
Low 3.4
Button Generator < 3.0 - Button Deletion via CSRF
The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack
-
Low 3.4
An issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted locally, and can be decrypt…
-
Low 3.5
It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all us…
-
Low 3.5
Apryse WebViewer PDF Document cross site scripting
A vulnerability was found in Apryse WebViewer up to 10.8.0. It has been classified as problematic. This affects an unknown part of the component PDF Document Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remote…
-
Low 3.3
MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.
-
Low 3.3
An issue in Tuya Smart camera U6N v.3.2.5 allows a remote attacker to cause a denial of service via a crafted packet to…
-
Low 2.1
An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) allows a physically proxima…
-
Low 3.5
PHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php cross site scripting
A vulnerability classified as problematic was found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file appointment-bwdates-reports-details.php. The manipulation of the argument fromda…
-
Low 2.4
Techkshetra Info Solutions Savsoft Quiz Category Page editCategory cross site scripting
A vulnerability was found in Techkshetra Info Solutions Savsoft Quiz 6.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /public/index.php/Qbank/editCategory of the component Category Page. The manipulation of t…
-
Low 2.7
BackUpWordPress <= 3.13 - Authenticated (Admin+) Directory Traversal
The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t…
-
Low 2.7
Netgear DG834Gv5 Web Management Interface cleartext storage
A vulnerability classified as problematic was found in Netgear DG834Gv5 1.6.01.34. This vulnerability affects unknown code of the component Web Management Interface. The manipulation leads to cleartext storage of sensitive information. The attack can be initi…
-
Low 3.8
MM-email2image <= 0.2.5 - Stored XSS via CSRF
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
-
Low 2.7
Mattermost fails to fully validate role changes
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.
-
Low 2.7
Mattermost allows team admins to promote guests to team admins
Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.
-
Low 3.1
Excessive resource consumption due to lack to request path size limits
Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending …
-
Low 3.5
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function i…
-
Low 2.9
Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds check
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.
-
Low 3.7
WordPress Quiz Maker plugin <= 6.3.9.4 - Content Spoofing
Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
-
Low 3.3
Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local…
-
Low 3.8
Floating Chat Widget < 3.1.9 - Editor+ Stored XSS
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per…
-
Low 3.5
Kashipara Online Furniture Shopping Ecommerce Website login.php cross site scripting
A vulnerability classified as problematic has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the file login.php. The manipulation of the argument txtAddress leads to cross site scripting. It is possibl…
-
Low 3.5
Kashipara Online Furniture Shopping Ecommerce Website prodInfo.php cross site scripting
A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file prodInfo.php. The manipulation of the argument prodId leads to cross sit…
-
Low 3.5
Kashipara Online Furniture Shopping Ecommerce Website prodList.php cross site scripting
A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file prodList.php. The manipulation of the argument prodType leads t…
-
Low 3.5
Kashipara Online Furniture Shopping Ecommerce Website search.php cross site scripting
A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is an unknown function of the file search.php. The manipulation of the argument txtSearch leads to cross site scripting. It…
-
Low 3.7
EZVIZ CS-C6-21WFR-8 Davinci Application certificate validation
A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davinci Application. The manipulation leads to improper certificate validation. It is possible to initiat…
-
Low 3.7
Hualai Xiaofang iSC5 certificate validation
A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper certificate validation. The attack may be launched remotely. The complexity of …
-
Low 2.2
Tillitis TKey Signer possible RAM disclosure vulnerability
The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom…
-
Low 3.9
QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async f…
-
Low 2.7CVE-2024-3177 Public exploit
Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFr…
-
Low 3.3
JADX file override vulnerability
### Summary when jadx parses a resource file, there is an escape problem with the style file, which can overwrite other files in the directory when saving the decompile result. Although I don't think this vulnerability realizes path traversal in the true sens…
-
Low 1.6
Authelia's Group Changes may not have the expected results (YAML file backend)
### Impact Under very specific conditions changes to a users groups may not have the expected results. The specific conditions are: * The file authentication backend is being used. * The [watch](https://www.authelia.com/configuration/first-factor/file/#watch)…
-
Low 3.5
l2c2technologies Koha opac-MARCdetail.pl cross site scripting
A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input…
-
Low 3.4
An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple devic…
-
Low 2.6
Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges vi…