Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,173
- Last 24h
- 683
- Critical, 7 days
- 364
- Known exploited
- 1,779
12,787 results · Clear filters · Feed
-
Low 3.8
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A l…
-
Low 3.8
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A l…
-
Low 3.5
Quarkus: information leak in annotation
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
-
Low 3.7
IBM Maximo Application Suite information disclosure
IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser…
-
Low 2.3
Session Token in URL in directus
Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web se…
-
Low 3.5
Open redirection using the return_url parameter in Peering Manager
Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a result users can be redirected to an unexpected location. This issue has been addressed in version 1.…
-
Low 3.7
Unbounded storage of information related to connection ID retirement, in quiche
Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers (IDs); see RFC 9000 S…
-
Low 3.9
An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports ma…
-
Low 2.4
EVE-NG Lab cross site scripting
A vulnerability was found in EVE-NG 5.0.1-13 and classified as problematic. Affected by this issue is some unknown functionality of the component Lab Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has…
-
Low 2.6
Sensitive Information Disclosure (JailID) to users in Collabora Online
Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instance in a different "jail" with a unique directory "jailID" name. For security reasons, this directory…
-
Low 3.3
In acpm_tmu_ipc_handler of tmu_plugin.c, there is a possible out of bounds read due to a missing bounds check. This cou…
-
Low 3.3
In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confu…
-
Low 1.6
Musicshelf SHA-1 PinningTrustManager.java weak password hash
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The ma…
-
Low 1.8
Musicshelf Backup androidmanifest.xml backup
A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized co…
-
Low 2.8
If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attac…
-
Low 2.8
If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged …
-
Low 3.7
keerti1924 Secret-Coder-PHP-Project secret_coder.sql inclusion of sensitive information in source code
A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /secret_coder.sql. The manipulation leads to inclusion of sensitive information in …
-
Low 3.8
Bdtask Hospital AutoManager Prescription Page improper authorization
A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /prescription/prescription/delete/ of the component Prescription Page. The manipulation leads to impr…
-
Low 3.5
boyiddha Automated-Mess-Management-System member_edit.php cross site scripting
A vulnerability, which was classified as problematic, has been found in boyiddha Automated-Mess-Management-System 1.0. Affected by this issue is some unknown functionality of the file /member/member_edit.php. The manipulation of the argument name leads to cro…
-
Low 3.5
boyiddha Automated-Mess-Management-System Chat Book chat.php cross site scripting
A vulnerability classified as problematic was found in boyiddha Automated-Mess-Management-System 1.0. Affected by this vulnerability is an unknown functionality of the file /member/chat.php of the component Chat Book. The manipulation of the argument msg lead…
-
Low 3.3
A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 17.4 and iPadOS 17.4, …
-
Low 3.3
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4. An a…
-
Low 3.3
This issue was addressed with improved data protection. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 1…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.6 a…
-
Low 3.3
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monte…
-
Low 2.4
The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4. Shake-to-undo may allow …
-
Low 2.4
Bdtask G-Prescription Gynaecology & OBS Consultation Software Edit Venue Page cross site scripting
A vulnerability has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Venue_controller/edit_venue/ of the component Edit Venue…
-
Low 2.4
Bdtask G-Prescription Gynaecology & OBS Consultation Software OBS Patient/Gynee Prescription cross site scripting
A vulnerability, which was classified as problematic, was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. Affected is an unknown function of the component OBS Patient/Gynee Prescription. The manipulation of the argument Patient Tit…
-
Low 2.4
Bdtask G-Prescription Gynaecology & OBS Consultation Software Prescription Dashboard Index cross site scripting
A vulnerability, which was classified as problematic, has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. This issue affects some unknown processing of the file /Home/Index of the component Prescription Dashboard. The manipula…
-
Low 3.5
keerti1924 Secret-Coder-PHP-Project Login Page login.php cross site scripting
A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file /login.php of the component Login Page. The manipulation of the argument emailcookie/passwordcookie le…
-
Low 2.7
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote a…
-
Low 2.7
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at …
-
Low 3.8
spmi: mediatek: Fix UAF on device remove
In the Linux kernel, the following vulnerability has been resolved: spmi: mediatek: Fix UAF on device remove The pmif driver data that contains the clocks is allocated along with spmi_controller. On device remove, spmi_controller will be freed first, and then…
-
Low 3.9
Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileg…
-
Low 2.2
Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type
Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field whic…
-
Low 3.7
Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in …
-
Low 2.4
A logic issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4. A user's l…
-
Low 3.8
Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition)
Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped server could potentia…
-
Low 3.3
Out of bounds Read vulnerability in ssmis_get_frm in libsubextractor.so prior to SMR Mar-2024 Release 1 allows local at…
-
Low 3.3
The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to …