Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,962
- Last 24h
- 1,963
- Critical, 7 days
- 354
- Known exploited
- 1,779
107,885 results · Clear filters · Feed
-
Medium 4.3
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step.
-
Medium 5.9
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique.
-
Medium 6.5
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control.
-
Medium 4.3
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers.
-
Medium 6.1
draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype obj…
-
Medium 5.8
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 share…
-
Medium 5.8
Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass
Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 direc…
-
Medium 5.3
blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for …
-
Medium 5.3
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive…
-
Medium 6.7
Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer
Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp dire…
-
Medium 4.4
Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File
Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output…
-
Medium 6.1
go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab…
-
Medium 5.3
CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 …
-
Medium 5.9
reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket
reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can…
-
Medium 6.5
netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-i…
-
Medium 6.5
Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP con…
-
Medium 5.3
vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scriptin…
-
Medium 6.5
vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-ch…
-
Medium 6.1
vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList
vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST…
-
Medium 5.4
IBM MQ Appliance is affected by an improper validation vulnerability
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
-
Medium 5.4
IBM MQ is affected by a denial of service vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of se…
-
Medium 6.2
IBM MQ is affected by a pasword disclosure vulnerability in the runmqccred utility
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.
-
Medium 5.3
Nexus Repository 3 - Group Repository Member Authorization Bypass
Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege …
-
Medium 6.3
Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in t…
-
Medium 6.3
Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle
Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spati…
-
Medium 6.5
Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission
Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that …
-
Medium 5.3
Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true …
-
Medium 6.5
Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. …
-
Medium 6.9
OmniAuth: Host Header Injection Vulnerability
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured.…
-
Medium 5.1
Zammad: Stored XSS in ticket article rendering in the new Vue-based interface
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpr…
-
Medium 6.5
Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal
Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope inst…
-
Medium 6.1
On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credential…
-
Medium 4.3
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X…
-
Medium 6.3
InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads …
-
Medium 5.9
BIG-HKSCS decoding hang on crafted input
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
-
Medium 6.5
GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(…
-
Medium 6.1
Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-…
-
Medium 5.3
Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. This vulnerability is due to …
-
Medium 5.9
ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a rem…
-
Medium 4.9
Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot se…