Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,259
- Last 24h
- 676
- Critical, 7 days
- 370
- Known exploited
- 1,779
12,797 results · Clear filters · Feed
-
Low 2.2
MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it pos…
-
Low 3.3
LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with administrator or…
-
Low 2.1
Elastic APM .NET Agent information disclosure
The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an applica…
-
Low 3.1
Kibana path traversal issue
It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.
-
Low 3.5
Nextcloud Mail app vulnerable to Server-Side Request Forgery
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versio…
-
Low 2.4
Nextcloud Server admins can change authentication details of user configured external storage
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of …
-
Low 3.5
Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTM…
-
Low 3.5
Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles …
-
Low 3.1CVE-2023-47643 Scanner template
SuiteCRM has Unauthenticated Graphql Introspection Enabled
SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the Gra…
-
Low 2.5
Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-ser…
-
Low 2.5
Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-ser…
-
Low 3.3
ZDI-CAN-21790: Adobe After Effects MP4 File Uninitialized Variable Information Disclosure Vulnerability
Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations suc…
-
Low 3.5
Concrete CMS Cross-site Scripting vulnerability
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.
-
Low 3.9
Use-After-Free in win_close() in vim
Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which…
-
Low 3.9
Floating point Exception in adjust_plines_for_skipcol() in vim
Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present…
-
Low 2.8
overflow with count for :s command in vim
Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situatio…
-
Low 2.8
overflow in nv_z_get_count in vim
Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addr…
-
Low 2.8
overflow in ex address parsing in vim
Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the o…
-
Low 2.8
overflow in get_number in vim
Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has b…
-
Low 2.8
overflow in shift_line in vim
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not…
-
Low 3.3
ZDI-CAN-21792: Adobe Premiere Pro MP4 File Uninitialized Variable Information Disclosure Vulnerability
Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such a…
-
Low 2.7
Gotham Video Broken Authentication
The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized.
-
Low 2.7
DoS via long hostnames
Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames.
-
Low 3.5
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information dis…
-
Low 3.7
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network acces…
-
Low 3.1
Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a den…
-
Low 3.4
Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Lengt…
-
Low 3.7
Information Disclosure in Install Tool in typo3/cms-install
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This …
-
Low 2.3
Improper buffer restrictions in some Intel(R) QAT Library software before version 22.07.1 may allow a privileged user t…
-
Low 2.6
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentia…
-
Low 3.9
Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated use…
-
Low 3.3
Exposure of sensitive information to an unauthorized actor in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may…
-
Low 1.9
Incomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service v…
-
Low 1.9
Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of serv…
-
Low 1.9
Improper access control for some Intel Unison software may allow a privileged user to potentially enable denial of serv…
-
Low 2.2
Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated us…
-
Low 2.2
Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalati…
-
Low 2.5
Insertion of sensitive information into log file for some Intel Unison software may allow an authenticated user to pote…
-
Low 3.3
Insufficient control flow management for some Intel Unison software may allow an authenticated user to potentially enab…
-
Low 3.3
Incomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information dis…