Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,588
- Last 24h
- 511
- Critical, 7 days
- 344
- Known exploited
- 1,779
108,045 results · Clear filters · Feed
-
Medium 5.3
bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal
A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path tra…
-
Medium 5.3
Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery
A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the arg…
-
Medium 4.3
zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service
A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The e…
-
Medium 5.5
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables…
-
Medium 4.3
zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack …
-
Medium 6.1
Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface: versions before 11.2. https://github.co…
-
Medium 5.9
Interuse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0.
-
Medium 6.5
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant is reach…
-
Medium 6.5
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notifi…
-
Medium 6.5
Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral while awa…
-
Medium 5.5
NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured without first checking the stream pointers. T…
-
Medium 4.8
Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return value of tha…
-
Medium 6.8
Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count
The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F), yielding a value of 0..15. In gt911_process() that value is used directly as the lo…
-
Medium 5.3
Channel tokens and organization API key exposed in API responses
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integratio…
-
Medium 6.5
pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid pri…
-
Medium 5.3
pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like lo…
-
Medium 6.3
erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the ar…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retri…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId v…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every sys_c…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove a…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list …
-
Medium 6.5
JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent …
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary user…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's low_app_id, obtained fr…
-
Medium 4.3
JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getC…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguard…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from th…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-T…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and repl…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and d…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batch…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId para…