Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,413
- Last 24h
- 697
- Critical, 7 days
- 339
- Known exploited
- 1,779
12,723 results · Clear filters · Feed
-
Low 3.3
In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a m…
-
Low 3.7
aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash
A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insuffici…
-
Low 3.1
InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature…
-
Low 3.5
Microsoft Office SharePoint Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
-
Low 3.5
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
-
Low 3.5
Insufficient input validation vulnerability exists in certain NETGEAR RAX Models
An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A …
-
Low 2.5
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all …
-
Low 2.8
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIE…
-
Low 2.7
Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the …
-
Low 3.5
Cross-site request forgery in the Guardian/CMC login before 26.3.0
A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attack…
-
Low 3.5
star7th showdoc API Page Save Endpoint editormd.js cross site scripting
A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The att…
-
Low 3.8CVE-2026-73318 Public exploit
XenForo < 2.3.13 Missing Authorization via force-agreement Controller
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permi…
-
Low 2.7CVE-2026-73317 Public exploit
XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job clas…
-
Low 2.0
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process …
-
Low 2.3
Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs. mix usage_rules.search_docs search…
-
Low 3.5
Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts wit…
-
Low 3.5
Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts wit…
-
Low 2.2
Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Success…
-
Low 2.3
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel (an anti-typosquattin…
-
Low 2.1
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source U…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
-
Low 2.8
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
-
Low 3.5
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
-
Low 3.1
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canv…
-
Low 3.5
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
-
Low 3.7
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
-
Low 3.3
ImageMagick before 7.1.2-30 Heap-use-after-free via Layer
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial…
-
Low 2.5
ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy valid…
-
Low 3.3
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy v…
-
Low 3.3
ImageMagick before 7.1.2-30 Heap-use-after-free via GetList
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).
-
Low 3.7
ImageMagick before 7.1.2-30 Memory Leak via MSL decoder
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.
-
Low 3.7
ImageMagick before 7.1.2-30 Denial of Service Memory Budget
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.
-
Low 2.3
MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated user…
-
Low 2.3
MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields inclu…
-
Low 3.5
code-projects Hospital Information System Patient Management editPatient.php cross site scripting
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site script…
-
Low 3.5
HCL MyXalytics is affected by multiple security vulnerabilities.
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.
-
Low 3.5
HCL MyXalytics is affected by multiple security vulnerabilities.
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.
-
Low 3.5
HCL MyXalytics is affected by multiple security vulnerabilities.
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.
-
Low 1.8
OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial…