Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,502
- Last 24h
- 541
- Critical, 7 days
- 334
- Known exploited
- 1,779
108,010 results · Clear filters · Feed
-
Medium 4.4
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client…
-
Medium 5.5
MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that becom…
-
Medium 4.4
Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture
Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so…
-
Medium 4.7
muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../..…
-
Medium 5.4
XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaController::createVanit…
-
Medium 5.4
QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-cre…
-
Medium 5.4
wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no a…
-
Medium 5.4
QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room…
-
Medium 5.4
QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to su…
-
Medium 5.3
Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs …
-
Medium 5.4
QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-of…
-
Medium 5.4
QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to s…
-
Medium 6.5
vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, pho…
-
Medium 4.3
ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the i…
-
Medium 4.3
ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequ…
-
Medium 6.5
ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-co…
-
Medium 5.3
Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known se…
-
Medium 5.5
Adobe Framemaker | NULL Pointer Dereference (CWE-476)
Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of th…
-
Medium 5.5
Adobe Framemaker | Out-of-bounds Read (CWE-125)
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…
-
Medium 5.5
Adobe Framemaker | Out-of-bounds Read (CWE-125)
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in tha…
-
Medium 5.3
SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service
SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also …
-
Medium 6.8
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body ag…
-
Medium 6.2
Missing authentication for critical function in Swann Communications SWIFI-SE2KIC
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
-
Medium 6.2
Missing authentication for critical function in Swann Communications SWIFI-SE2KIC
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
-
Medium 6.2
Missing authentication for critical function in Swann Communications SWIFI-SE2KIC
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication.
-
Medium 4.3
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of…
-
Medium 4.9
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 th…
-
Medium 5.9
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerab…
-
Medium 6.5
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerab…
-
Medium 6.5
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerab…
-
Medium 4.8
An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox …
-
Medium 5.3
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
Medium 6.5
Unbounded memory allocation in the Prometheus rule conversion API
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
-
Medium 5.3
Git Sync memory exhaustion via a malicious Git server
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync…
-
Medium 6.3
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to th…
-
Medium 6.5
Git Sync connection configuration can be modified with read-only access
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental p…
-
Medium 4.3
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the …
-
Medium 5.5
Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as str…
-
Medium 6.5
Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow…
-
Medium 5.3
ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential artic…