Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,464
- Last 24h
- 603
- Critical, 7 days
- 334
- Known exploited
- 1,779
107,987 results · Clear filters · Feed
-
Medium 6.5
FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing…
-
Medium 5.9
FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap st…
-
Medium 6.5
FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened D…
-
Medium 4.3
FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious…
-
Medium 5.9
FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client a…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client…
-
Medium 5.3
qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string
### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-pr…
-
Medium 6.3
Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The …
-
Medium 5.3
itsmeravitejak Online-Examination-System dbtables.sql information disclosure
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is an unknown function of the file dbtables.sql. Executing a manipulation can lead to information disclosure. The a…
-
Medium 6.3
turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow
A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer …
-
Medium 6.3
OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root le…
-
Medium 5.3
OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Atta…
-
Medium 6.8
FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. I…
-
Medium 6.5
FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance ev…
-
Medium 5.3CVE-2026-104110 Public exploit
FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or …
-
Medium 6.4
FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already s…
-
Medium 6.5
FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollm…
-
Medium 5.4
FileRise renameFolder omits destination-parent authorization
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against th…
-
Medium 6.5
FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate user…
-
Medium 5.4
FileRise: Login Method Restriction Bypass via Direct API Access
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not consistently in the correspondi…
-
Medium 5.9
FileRise: Insecure default cryptographic key fallback in manual installs
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published le…
-
Medium 4.8
FileRise: Unsanitized footerHtml in Public Site Config
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API without server-side saniti…
-
Medium 4.3
Checkov by Prisma Cloud: Path Traversal Vulnerabilities
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
-
Medium 6.1
Cortex XSOAR: OS Command Injection Vulnerability
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
-
Medium 4.3
GlobalProtect App: Local Denial of Service (DoS) on Windows
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by th…
-
Medium 5.4
FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs …
-
Medium 5.9
GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. Th…
-
Medium 6.8
FileRise: Remember-me auto-login uses stale admin role from token instead of current role
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the accou…
-
Medium 4.6
PAN-OS: Denial of Service (DoS) on Panorama
A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Pano…
-
Medium 6.5
FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the de…
-
Medium 4.9
PAN-OS: Improper Input Handling Vulnerability
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by thi…
-
Medium 5.7
PAN-OS: Authenticated Admin Command Injection Vulnerability
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS …
-
Medium 6.6
PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services
Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repea…
-
Medium 4.8
FileRise Shared Folder Symlink Escape
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling direc…
-
Medium 6.5
cemtan sar2html sar2html.py deleteAll missing authentication
A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit ha…
-
Medium 6.5
WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted …
-
Medium 5.3
RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack…
-
Medium 6.5
Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewi…
-
Medium 6.5
Plane: Any project member can modify (deactivate) other members' records
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active fi…
-
Medium 6.8
InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only a…