Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,826
- Last 24h
- 2,076
- Critical, 7 days
- 351
- Known exploited
- 1,779
107,769 results · Clear filters · Feed
-
Medium 4.3
Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This r…
-
Medium 4.3
Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action o…
-
Medium 5.8
Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services)
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitat…
-
Medium 5.3
Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)
Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affe…
-
Medium 5.3
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an…
-
Medium 5.1
A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by thi…
-
Medium 6.2
The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access applicatio…
-
Medium 6.2
An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineere…
-
Medium 6.2
An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be revers…
-
Medium 6.2
The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application…
-
Medium 6.2
The RSA cryptographic key material, including a private key and public key, is embedded within the application package.…
-
Medium 4.4
Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console
SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This…
-
Medium 5.3
D-Link DCS-6501LH Media Service SystemConfig.ini mydlink_default_sys_info hard-coded credentials
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pf_get_onvif_user_pwd/mydlink_default_sys_info of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pin_code causes hard…
-
Medium 4.3
SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgery
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack…
-
Medium 6.9
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown fu…
-
Medium 5.4
Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 t…
-
Medium 5.3CVE-2026-125394 Public exploit
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and …
-
Medium 5.4
Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containin…
-
Medium 5.3
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in th…
-
Medium 6.5
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/repor…
-
Medium 6.0
langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageContr…
-
Medium 5.4
Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/a…
-
Medium 6.0
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role us…
-
Medium 6.5
DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test
DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT …
-
Medium 5.3
PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/…
-
Medium 5.3
VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles l…
-
Medium 5.4
MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers
MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning an…
-
Medium 5.3
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to acces…
-
Medium 5.3
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and det…
-
Medium 4.3
REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-d…
-
Medium 4.8
Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, s…
-
Medium 6.9
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers…
-
Medium 5.3
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server…
-
Medium 5.4
Pico through 4.1.2 SSRF in Feeds Service via run SSH Command
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigge…
-
Medium 5.4
MikroDash before 0.8.79 SSRF via Personal Notification Channels
MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN…
-
Medium 4.3
Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger p…
-
Medium 6.9
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::…
-
Medium 6.1
Kiwi TCMS account confirmation open redirect through protocol-relative URLs
## Summary In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated `next` parameter) in the account confirmation endpoint is incomplete. The validation uses `startswith("/")` to check if the redirect URL is local, but this is bypa…
-
Medium 5.1
KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitr…
-
Medium 6.5
Mongoose: Prototype pollution via Schema.prototype.virtual()
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by S…