Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,174
- Last 24h
- 676
- Critical, 7 days
- 364
- Known exploited
- 1,779
12,787 results · Clear filters · Feed
-
Low 2.5
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Low 3.8
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an au…
-
Low 3.8
Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow …
-
Low 3.8
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an au…
-
Low 3.4
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access t…
-
Low 3.3
Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potenti…
-
Low 3.3
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2…
-
Low 3.3
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2…
-
Low 3.3
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2…
-
Low 3.3
A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.…
-
Low 3.4
Opensc: memory use after free in authentic driver when updating token info
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system…
-
Low 3.5
dbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redos
A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality of the file packages/json-deserializer/src/JsonDeserializer.ts of the component…
-
Low 3.3
Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenti…
-
Low 2.7
Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error…
-
Low 3.1
KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal
A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. Th…
-
Low 3.9
HCL Sametime is impacted by a failure to invalidate sessions
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.
-
Low 1.7
HCL Sametime is impacted by a sensitive information disclosure
Sametime is impacted by sensitive information passed in URL.
-
Low 2.4
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into…
-
Low 2.0
Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature
Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execu…
-
Low 2.0CVE-2024-1247 Public exploit
Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which mig…
-
Low —
commonground-api-common unexploitable privilege escalation in JWT authentication middleware
### Impact This is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the Py…
-
Low 3.1
Incorrect Authorization leads to Channel Member Count Leak
Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.
-
Low 3.4
Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Ji…
-
Low 3.5
CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
-
Low 3.8
The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and incl…
-
Low 2.4CVE-2024-1269 Public exploit
SourceCodester Product Management System supplier.php cross site scripting
A vulnerability has been found in SourceCodester Product Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /supplier.php. The manipulation of the argument supplier_name/supplier_contact leads to cross sit…
-
Low 3.5
CodeAstro Restaurant POS System create_account.php cross site scripting
A vulnerability, which was classified as problematic, has been found in CodeAstro Restaurant POS System 1.0. Affected by this issue is some unknown functionality of the file create_account.php. The manipulation of the argument Full Name leads to cross site sc…
-
Low 2.4
CodeAstro University Management System Student Registration Form st_reg.php cross site scripting
A vulnerability classified as problematic was found in CodeAstro University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /st_reg.php of the component Student Registration Form. The manipulation of the argument …
-
Low 2.4
CodeAstro University Management System Attendance Management att_add.php cross site scripting
A vulnerability classified as problematic has been found in CodeAstro University Management System 1.0. Affected is an unknown function of the file /att_add.php of the component Attendance Management. The manipulation of the argument Student Name leads to cro…
-
Low 3.1
Juanpao JPShop API params.php hard-coded key
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWT_KEY_ADMIN le…
-
Low 3.5
Jspxcms find_text.do cross site scripting
A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploi…
-
Low 3.5
Jspxcms filter_text.do cross site scripting
A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit ha…
-
Low 3.3
Grub2: grub2-set-bootflag can be abused by local (pseudo-)users
A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename o…
-
Low 2.8
In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
-
Low 3.3
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
-
Low 2.4
Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers t…
-
Low 3.3
Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to …
-
Low 3.7
Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass
The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and including, 2.37. This is due to the plugin improperly validating the request path. This makes it pos…
-
Low 3.7
Vyper SHA3 code generation bug
Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand…
-
Low 2.7
Sulu is vulnerable to HTML Injection via Autocomplete Suggestion
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can cre…