Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,693
- Last 24h
- 433
- Critical, 7 days
- 344
- Known exploited
- 1,779
108,120 results · Clear filters · Feed
-
Medium 4.3
Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbit…
-
Medium 5.9
Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which inclu…
-
Medium 6.5
Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from un…
-
Medium 4.3
Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete
The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's config…
-
Medium 5.0
Pulp-rpm: distribution tree publish creates directories from .treeinfo ids
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write…
-
Medium 6.5
Pulp-ansible: bearer tokens are reused across remotes in a worker
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can po…
-
Medium 6.5
Pulp-container: registry credentials are reused across remotes in a worker
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server the…
-
Medium 6.9
wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) when a server receives them from an unauthenticated client. IsMessageAllowedServ…
-
Medium 5.3
wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFT…
-
Medium 6.3
wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allo…
-
Medium 5.5
Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file
A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smal…
-
Medium 6.5
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
-
Medium 4.3
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.
-
Medium 6.5
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
-
Medium 6.1
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user …
-
Medium 6.1
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user …
-
Medium 5.5
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an …
-
Medium 5.5
An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.
-
Medium 6.5
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.
-
Medium 5.5
Sssd: sssd-kcm: local denial of service via excessive memory preallocation
A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate si…
-
Medium 5.3
Backstage: Potential file exposure through local TechDocs publisher
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.ty…
-
Medium 5.3
Backstage: TechDocs arbitrary file read via mkdocs snippets
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an auth…
-
Medium 5.3
Backstage: Improper input validation in scaffolder task list ordering
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to creat…
-
Medium 6.5
Backstage: Sensitive information exposure in scaffolder task logs
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tas…
-
Medium 4.3
Gitea profile feed disclosure bypassing user visibility
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` …
-
Medium 6.1
Gitea repository media API stored XSS
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file commi…
-
Medium 5.4
Gitea push-to-create bypass of FORCE_PRIVATE policy
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new…
-
Medium 4.3
Gitea issue attachment API allows changing comment attachments
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a use…
-
Medium 6.5
Gitea migration memory exhaustion from zero page size
When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server…
-
Medium 5.3
Backstage: Sensitive information may be exposed in Scaffolder task failure events
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authentica…
-
Medium 4.9
Backstage: Secret-derived values may be exposed in scaffolder task logs
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secr…
-
Medium 4.3
Backstage: Inconsistent catalog property permission evaluation
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission co…
-
Medium 4.9
Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could th…
-
Medium 5.5
NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of thi…
-
Medium 4.4
Backstage: Improper input validation in cloud storage URL readers
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Back…
-
Medium 6.5
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during deco…
-
Medium 6.4
Backstage: Improper input validation in proxy-backend
Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the pr…
-
Medium 6.5
Backstage: Improper input validation in TechDocs static content requests
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenti…
-
Medium 6.5
Backstage: Improper authorization enforcement for TechDocs static content
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs docu…
-
Medium 4.7
Sssd: sssd: denial of service via race condition in autofs responder
A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalida…