Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,431
- Last 24h
- 768
- Critical, 7 days
- 374
- Known exploited
- 1,779
12,820 results · Clear filters · Feed
-
Low —
Hop-by-hop abuse to malform header mutator
### Impact Downstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config: ```y…
-
Low 3.5
UCMS Column Configuration saddpost.php cross site scripting
A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the component Column Configuration. The manipulation of the argument strorder leads to cross site scripting. It is possibl…
-
Low 2.4
SourceCodester Purchase Order Management System cross site scripting
A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=save_item. The manipulation of the argument description with the input <scri…
-
Low 3.3
Git looks for localized messages in the wrong place
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…
-
Low 3.1
Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Window…
-
Low 3.1
Nextcloud Server missing brute force protection for passwords of password protected share links
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11,…
-
Low 3.1
Archiving a team broadcasts unsanitized data over WebSockets
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
-
Low 3.8
PingID integration for Windows login duplicate username collision.
PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.
-
Low 3.5
Kau-Boy Backend Localization Plugin backend_localization.php localize_backend cross site scripting
A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend o…
-
Low 3.5
Kau-Boy Backend Localization Plugin backend_localization.php cross site scripting
A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulation leads to cross site scripting. The a…
-
Low 3.9
Kiwi TCMS may allow user to update email address to unverified one
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account witho…
-
Low 3.3
NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may ena…
-
Low 3.3
NVIDIA CUDA Toolkit SDK for Linux and Windows contains a NULL pointer dereference in cuobjdump, where a local user runn…
-
Low 3.2
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which ca…
-
Low 3.3
Velociraptor crashes while parsing some malformed PE or OLE files.
Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to be able to in…
-
Low 3.5
Dream Technology mica Form Object cross site scripting
A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Object Handler. The manipulation leads to cross site scripting. It is possible to launch the attack re…
-
Low 3.5
SourceCodester Task Reminder System Users.php cross site scripting
A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as problematic. This issue affects some unknown processing of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack may be…
-
Low 3.5
Campcodes Coffee Shop POS System Users.php cross site scripting
A vulnerability classified as problematic was found in Campcodes Coffee Shop POS System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument firstname leads to cross site scripting. T…
-
Low 3.3
Datakit CrossCAD/Ware
Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information.
-
Low 3.3
Datakit CrossCAD/Ware
Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information.
-
Low 3.3
Datakit CrossCAD/Ware
Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information.
-
Low 3.3
CVE-2023-22295
Datakit CrossCadWare_x64.dll contains an out of bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information.
-
Low 3.6
Desktop component allows lateral movement between sessions
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.
-
Low 3.5
mportuga eslint-detailed-reporter template-generator.js renderIssue cross site scripting
A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site…
-
Low 3.5
Cross-site Scripting (XSS) - Stored in azuracast/azuracast
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
-
Low 2.9
FTP Agent forwards traffic on inactive ports to LinkManager
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
-
Low 2.7
Denial of service via admin theme import route in Discourse
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting …
-
Low 2.4CVE-2023-26049 Public exploit
Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a co…
-
Low 3.3
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affecte…
-
Low 3.6
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Low 3.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Low 3.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions …
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Low 1.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: IPS repository daemon). The supported version…
-
Low 2.4
SourceCodester Air Cargo Management System cross site scripting
A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file classes/Master.php?f=save_cargo_type. The manipulation of the argument name leads to cross si…
-
Low 3.5
SourceCodester Complaint Management System POST Parameter editable_ajax.php cross site scripting
A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php of the comp…
-
Low 3.5
Chat poll data can still be queried from API after purging history in Nextcloud talk
Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has…