Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,336
- Last 24h
- 735
- Critical, 7 days
- 376
- Known exploited
- 1,779
12,815 results · Clear filters · Feed
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…
-
Low 2.4CVE-2023-22074 Public exploit
Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected…
-
Low 2.4
Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java …
-
Low 2.7
WAGO: Multiple products vulnerable to local file inclusion
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.
-
Low 2.7
IBM Security Verify Privilege information disclosure
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force …
-
Low 3.7
IBM Security Verify Privilege information disclosure
IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which could aid further attacks against the system. IBM X-Force ID: 240455.
-
Low 2.7
IBM Security Verify Privilege denial of service
IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634.
-
Low 2.0
Blind Server Side Request Forgery (SSRF) in remote schedule import feature in Engelsystem
Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be de…
-
Low 3.6
Session is not expiring after password reset in Engelsystem
Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is r…
-
Low 3.7
Exposure of poll options and votes to unauthorized users in Discourse
Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll partic…
-
Low 3.5
Possible XSS execution in customer information
An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for Ad…
-
Low 3.3
IBM Security Verify Governance file upload
IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382.
-
Low 2.3
IBM Security Verify Governance information disclosure
IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 257769.
-
Low 2.6
kphrx pleroma pack.ex Pleroma.Emoji.Pack path traversal
A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack i…
-
Low 2.4
SourceCodester Online Motorcycle Rental System Bike List cross site scripting
A vulnerability was found in SourceCodester Online Motorcycle Rental System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/?page=bike of the component Bike List. The manipulation of the argument Model with…
-
Low 3.5
ZZZCMS Personal Profile Page cross site scripting
A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Profile Page. The manipulation leads to basic cross site scripting. The attack may be initiated remotely…
-
Low 3.5
SourceCodester Medicine Tracker System index.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack can be initiated …
-
Low 3.5
yhz66 Sandbox User Data information disclosure
A vulnerability was found in yhz66 Sandbox 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /im/user/ of the component User Data Handler. The manipulation leads to information disclosure. The exploit ha…
-
Low 3.5
Portábilis i-Educar HTTP GET Request agenda_imprimir.php cross site scripting
A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>aler…
-
Low 3.8
QTS, QuTS hero, QuTScloud
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.4
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet Forti…
-
Low 3.2
Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp
Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
-
Low 3.9
Undici's cookie header not cleared on cross-origin redirect in fetch
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disa…
-
Low 3.7
Deleting a collaboration should also delete linked resources
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unl…
-
Low 3.4
A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1…
-
Low 3.1
Translator PoqDev Add-On Select Text cross site scripting
A vulnerability was found in Translator PoqDev Add-On 1.0.11 on Firefox. It has been rated as problematic. This issue affects some unknown processing of the component Select Text Handler. The manipulation leads to cross site scripting. The attack may be initi…
-
Low 3.4
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 throug…
-
Low 3.0
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0,…
-
Low 3.9
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allo…
-
Low 3.7
Delta Electronics WPLSoft Modbus cleartext transmission
A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to l…
-
Low 3.5
Delta Electronics WPLSoft Modbus Data Packet heap-based overflow
A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic. This issue affects some unknown processing of the component Modbus Data Packet Handler. The manipulation leads to heap-based buffer overflow. The exploit has been…
-
Low 3.2
Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigge…
-
Low 3.7
IBM Security Directory Suite information disclosure
IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 228568.
-
Low 3.8
QTS, QuTS hero, QuTScloud
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.8
QTS, QuTS hero, QuTScloud
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.3
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linu…
-
Low 3.3
Sensitive information disclosure due to excessive collection of system information. The following products are affected…
-
Low —
gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results
### Impact When the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). The issue impacts all users using `ExpG…
-
Low 3.2
Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations
Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file…