Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,172
- Last 24h
- 695
- Critical, 7 days
- 364
- Known exploited
- 1,779
12,787 results · Clear filters · Feed
-
Low 3.1
Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain …
-
Low 3.5
HPE OfficeConnect 1820 Network switches, Cross-Site Request Forgery (CSRF)
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820 Network switches. The vulnerability could be remotely exploited to allow execution of malicious code.
-
Low 2.4
slowlyo OwlAdmin Image File Upload upload_image cross site scripting
A vulnerability, which was classified as problematic, has been found in slowlyo OwlAdmin up to 3.5.7. Affected by this issue is some unknown functionality of the file /admin-api/upload_image of the component Image File Upload. The manipulation of the argument…
-
Low 2.7
Tuya SDK MQTT Packet denial of service
** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown function of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. T…
-
Low 2.4
Emlog Pro Post Tag tag.php cross site scripting
A vulnerability was found in Emlog Pro 2.2.10. It has been rated as problematic. This issue affects some unknown processing of the file /admin/tag.php of the component Post Tag Handler. The manipulation leads to cross site scripting. The attack may be initiat…
-
Low 2.4
Emlog Pro Whisper Page twitter.php cross site scripting
A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of the component Whisper Page. The manipulation leads to cross site scripting. The attack can be initiat…
-
Low 3.7
Smart Office Main.aspx weak password
A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the file Main.aspx. The manipulation of the argument New Password/Confirm Password with the input 1 leads to weak password requ…
-
Low 3.5
SourceCodester Computer Laboratory Management System Users.php cross site scripting
A vulnerability has been found in SourceCodester Computer Laboratory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting…
-
Low 3.7
Zhejiang Land Zongheng Network Technology O2OA information disclosure
A vulnerability classified as problematic has been found in Zhejiang Land Zongheng Network Technology O2OA up to 20240403. Affected is an unknown function of the file /x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3. The manipulation leads to in…
-
Low 3.5
bihell Dice Comment cross site scripting
A vulnerability was found in bihell Dice 3.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The explo…
-
Low 3.7
WordPress Sumo plugin <= 1.34 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in SumoMe Sumo.This issue affects Sumo: from n/a through 1.34.
-
Low 3.5
SourceCodester Warehouse Management System pengguna.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Warehouse Management System 1.0. This vulnerability affects unknown code of the file pengguna.php. The manipulation of the argument admin_user/admin_nama/admin_alamat/admin_telepon leads to…
-
Low 3.5
SourceCodester Warehouse Management System customer.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Warehouse Management System 1.0. This affects an unknown part of the file customer.php. The manipulation of the argument nama_customer/alamat_customer/notelp_customer leads to cross si…
-
Low 3.5
SourceCodester Warehouse Management System supplier.php cross site scripting
A vulnerability was found in SourceCodester Warehouse Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file supplier.php. The manipulation of the argument nama_supplier/alamat_supplier/notelp…
-
Low 3.5
SourceCodester Warehouse Management System barang.php cross site scripting
A vulnerability was found in SourceCodester Warehouse Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file barang.php. The manipulation of the argument nama_barang/merek leads to cr…
-
Low 2.2
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found …
-
Low 3.7
Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap c…
-
Low 2.0
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output
### Impact _What kind of vulnerability is it? Who is impacted?_ Storage credentials are written to the console. ### Patches _Has the problem been patched?_ Yes, see #3589 _What versions should users upgrade to?_ - Any version after or including commit 1d6f852…
-
Low 3.4CVE-2024-3568 Public exploit
Arbitrary Code Execution via Deserialization in huggingface/transformers
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by craf…
-
Low 3.7
WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerability
Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.7.
-
Low 3.5
Campcodes Church Management System add_visitor.php cross site scripting
A vulnerability classified as problematic was found in Campcodes Church Management System 1.0. This vulnerability affects unknown code of the file /admin/add_visitor.php. The manipulation of the argument mobile leads to cross site scripting. The attack can be…
-
Low 3.5
Campcodes Church Management System admin_user.php cross site scripting
A vulnerability classified as problematic has been found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/admin_user.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to ini…
-
Low 3.5
Campcodes Complete Online Student Management System academic_year_view.php cross site scripting
A vulnerability classified as problematic was found in Campcodes Complete Online Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file academic_year_view.php. The manipulation of the argument FirstRecord leads t…
-
Low 3.5
Campcodes Complete Online Student Management System attendance_view.php cross site scripting
A vulnerability classified as problematic has been found in Campcodes Complete Online Student Management System 1.0. Affected is an unknown function of the file attendance_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. I…
-
Low 3.5
Campcodes Complete Online Student Management System courses_view.php cross site scripting
A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file courses_view.php. The manipulation of the argument FirstRecord leads to cross site s…
-
Low 3.7
Insecure SQL Interface affects HCL DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malicious user can run arbitrary SQL commands including changing system configuration.
-
Low 3.5
Campcodes Complete Online Student Management System Marks_view.php cross site scripting
A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file Marks_view.php. The manipulation of the argument FirstRecord leads to cross site scr…
-
Low 3.5
Campcodes Complete Online Student Management System students_view.php cross site scripting
A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been classified as problematic. This affects an unknown part of the file students_view.php. The manipulation of the argument FirstRecord leads to cross site scripting…
-
Low 3.5
Campcodes Complete Online Student Management System units_view.php cross site scripting
A vulnerability was found in Campcodes Complete Online Student Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file units_view.php. The manipulation of the argument FirstRecord leads to cross si…
-
Low 3.5
Campcodes Online Event Management System index.php cross site scripting
A vulnerability has been found in Campcodes Online Event Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument msg leads to cross site scripting.…
-
Low 3.5
Campcodes Online Event Management System index.php cross site scripting
A vulnerability, which was classified as problematic, was found in Campcodes Online Event Management System 1.0. Affected is an unknown function of the file /views/index.php. The manipulation of the argument msg leads to cross site scripting. It is possible t…
-
Low 3.1
An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability a…
-
Low 3.5
Campcodes Online Event Management System process.php cross site scripting
A vulnerability, which was classified as problematic, has been found in Campcodes Online Event Management System 1.0. This issue affects some unknown processing of the file /views/process.php. The manipulation of the argument name leads to cross site scriptin…
-
Low 3.6
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker wi…
-
Low 3.1
Contao may have unencoded insert tags in the frontend
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 …
-
Low 3.3
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), P…
-
Low 3.3
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), P…
-
Low 3.5
SourceCodester Laundry Management System edit cross site scripting
A vulnerability has been found in SourceCodester Laundry Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /karyawan/edit. The manipulation of the argument karyawan leads to cross site scripting. The atta…
-
Low 3.5
SourceCodester Prison Management System apply_leave.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employee/apply_leave.php. The manipulation of the argument txtstart_date/txtend_date leads to cross site s…
-
Low 3.5
namithjawahar Wp-Insert cross site scripting
A vulnerability was found in namithjawahar Wp-Insert up to 2.0.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0…