Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,248
- Last 24h
- 676
- Critical, 7 days
- 366
- Known exploited
- 1,779
12,795 results · Clear filters · Feed
-
Low 3.5
code-projects Dormitory Management System modifyuser.php information disclosure
A vulnerability was found in code-projects Dormitory Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file modifyuser.php. The manipulation of the argument mname leads to information disclosure. The ex…
-
Low 3.1
Discourse secure uploads accessible to guests even when login is required
Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
-
Low 3.5
Reaction data for user notifications exposed in Discourse-reactions
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
-
Low 3.5
code-projects Employee Profile Management System edit_position_query.php cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file edit_position_query.php. The manipulation of the argument pos_name leads to cross site scripti…
-
Low 3.5
code-projects Employee Profile Management System download.php path traversal
A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument download_file leads to path traversal: '../filedir'…
-
Low 3.5
Improper Verification of Cryptographic Signature in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.
-
Low 3.5
cloudfavorites favorites-web Nickname cross site scripting
A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack may …
-
Low 3.5
qkmc-rk redbbs Nickname cross site scripting
A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The e…
-
Low 3.5
CodeAstro Simple Banking System Create a User Page createuser.php cross site scripting
A vulnerability classified as problematic has been found in CodeAstro Simple Banking System 1.0. This affects an unknown part of the file createuser.php of the component Create a User Page. The manipulation leads to cross site scripting. It is possible to ini…
-
Low 3.5
CodeAstro Online Food Ordering System dishes.php cross site scripting
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file dishes.php. The manipulation of the argument res_id leads to cross site scripting. The a…
-
Low 3.5
CodeAstro POS and Inventory Management System New Item Creation Page new_item cross site scripting
A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /new_item of the component New Item Creation Page. The manipulation of …
-
Low 3.2CVE-2023-20573 Public exploit
Debug Exception Delivery in Secure Nested Paging
A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debug information.
-
Low 3.5
qkmc-rk redbbs Post cross site scripting
A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0. Affected is an unknown function of the component Post Handler. The manipulation of the argument title leads to cross site scripting. It is possible to launch the attack remotely. …
-
Low 3.1
My Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure
The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incorrect nonce validation in mystickymenu-contact-leads.php. This makes it possible for unauthenticated …
-
Low 2.2
cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code
cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in u…
-
Low 3.3
The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 1…
-
Low 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, iOS…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and…
-
Low 3.3
A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be …
-
Low 3.3CVE-2023-28197 Public exploit
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Bi…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventur…
-
Low 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.2 and iPadOS 1…
-
Low 2.4
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17 and iPadOS 17.…
-
Low 3.1
Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer. This issue affects Apache Answer: through 1.2.0. Under normal circumstances, a user can only bookmark a question once, and will only in…
-
Low 3.1
SourceCodester Engineers Online Portal session fixiation
A vulnerability classified as problematic has been found in SourceCodester Engineers Online Portal 1.0. This affects an unknown part. The manipulation leads to session fixiation. It is possible to initiate the attack remotely. The complexity of an attack is r…
-
Low 3.1
SourceCodester Engineers Online Portal session expiration
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to session expiration. The attack may be launched remotely. The complexity …
-
Low 3.7
SourceCodester Engineers Online Portal missing secure attribute
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. The attack can be la…
-
Low 3.7
SourceCodester Engineers Online Portal signup_teacher.php weak password
A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file signup_teacher.php. The manipulation of the argument Password leads to weak password requirements. Th…
-
Low 3.5
CodeAstro Vehicle Booking System Feedback Page user-give-feedback.php cross site scripting
A vulnerability has been found in CodeAstro Vehicle Booking System 1.0 and classified as problematic. This vulnerability affects unknown code of the file usr/user-give-feedback.php of the component Feedback Page. The manipulation of the argument My Testemonia…
-
Low 3.5
Inis GET Request File.php path traversal
A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/default/File.php of the component GET Request Handler. The manipulation of the argument path leads to p…
-
Low 3.3
A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions <…
-
Low 3.7
URL Redirection vulnerability in SAP Marketing (Contacts App)
SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application.
-
Low 3.7
WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
-
Low 3.5
Chanzhaoyu chatgpt-web cross site scripting
A vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1. This issue affects some unknown processing. The manipulation of the argument Description with the input <image src onerror=prompt(document.domain)> leads to…
-
Low 3.5
Kashipara Food Management System party_submit.php cross site scripting
A vulnerability was found in Kashipara Food Management System up to 1.0. It has been rated as problematic. This issue affects some unknown processing of the file party_submit.php. The manipulation of the argument party_address leads to cross site scripting. T…
-
Low 3.5
Kashipara Food Management System party_details.php cross site scripting
A vulnerability was found in Kashipara Food Management System up to 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file party_details.php. The manipulation of the argument party_name leads to cross site scripting. The…
-
Low 3.5
Kashipara Food Management System addmaterialsubmit.php cross site scripting
A vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as problematic. This affects an unknown part of the file addmaterialsubmit.php. The manipulation of the argument tin leads to cross site scripting. It is possible …
-
Low 2.4
Online Job Portal Create News Page News.php cross site scripting
A vulnerability was found in Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Admin/News.php of the component Create News Page. The manipulation of the argument News with the input </title>…
-
Low 3.3
arm32: The cache may not be properly cleaned/invalidated (take two)
Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Un…
-
Low 3.8
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…