Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,353
- Last 24h
- 679
- Critical, 7 days
- 357
- Known exploited
- 1,779
12,722 results · Clear filters · Feed
-
Low 3.7
cpp-httplib open_stream serializes CRLF in request target into HTTP request line
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffer…
-
Low 3.5
Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used
An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message.
-
Low 3.7
Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple…
-
Low 3.1
Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a sessio…
-
Low 3.3
Talos Linux: Support bundle does not redact registry credentials
Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in genera…
-
Low 3.6
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_transla…
-
Low 2.9
rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more…
-
Low 2.5
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary…
-
Low 2.5
Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_l…
-
Low 3.3
VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt
VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported Ve…
-
Low 3.3
CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes AD…
-
Low 3.3
vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector…
-
Low 3.1
miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network…
-
Low 3.3
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or…
-
Low 3.1
miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving d…
-
Low 3.5
Gitea Jupyter notebook UI redress through CSS class injection
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply mult…
-
Low 3.1
Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /doc…
-
Low 3.3
LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC10…
-
Low 3.6
Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, cor…
-
Low 3.5
BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client nam…
-
Low 3.3
OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter
OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructor…
-
Low 3.3
PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint
PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry n…
-
Low 3.3
Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dro…
-
Low 3.8
HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability
A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.
-
Low 2.0
HPE NonStop Hpjmeter - Buffer overflow vulnerability
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
-
Low 2.7
WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside …
-
Low 3.7
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability …
-
Low 3.7
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability …
-
Low 3.7
Denial of Service via sending bogus X.509 certificates
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimat…
-
Low 3.1
Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin …
-
Low 3.5
Indico legacy contribution export cache poisoning discloses restricted metadata
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privile…
-
Low 3.7
Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can sub…
-
Low 3.3
Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to…
-
Low 2.7
Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route
Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing t…
-
Low 3.1
Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host reb…
-
Low 3.7
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, con…
-
Low 3.7
Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signat…
-
Low 3.3
Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices
A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous bl…
-
Low 2.1
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, …
-
Low 3.4
A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or co…