3620 matches found
CVE-2025-23658
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a through = 1.1.0...
CVE-2025-23851 WordPress Coronavirus (COVID-19) Outbreak Data Widgets Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Khushwant Singh Coronavirus COVID-19 Outbreak Data Widgets coronavirus-data-widgets allows Reflected XSS.This issue affects Coronavirus COVID-19 Outbreak Data Widgets: from n/a through = 1.1.1...
CVE-2025-23787
CVE-2025-23787 is a WordPress WordPress plugin issue in the NotFound Easy Bet plugin (Easy Bet) with a Reflected XSS vulnerability that affects versions up to 1.0.7. The flaw is described as improper input neutralization during web page generation, enabling reflected cross-site scripting. The CVS...
CVE-2024-36788
Netgear WNR614 JNR1010V2 N300-V1.1.0.541.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensitive communications between the router and connected devices...
CVE-2025-26791
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting mXSS...
Azure Linux 3.0 Security Update: nodejs / nodejs18 (CVE-2024-21892)
The version of nodejs / nodejs18 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21892 advisory. - On Linux, Node.js ignores certain environment variables if those May have been set by an...
RockyLinux 8 : gcc-toolset-13-gcc (RLSA-2025:1306)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:1306 advisory. jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 Tenable has extracted the preceding description block directly...
ManageEngine Endpoint Central 11.3.2428.x <= 11.3.2428.01, 11.3.2440.x <= 11.3.2440.0 Insecure Direct Object References
The version of ManageEngine Endpoint Central installed on the remote Windows host is either prior to 11.3.2428.26 or prior to 11.3.2440.09. It is,therefore, affected by an insecure direct object references vulnerability. For more information, consult the vendor advisory. Note that Nessus has not...
CVE-2025-26574
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moch Amir Google Drive WP Media google-drive-wp-media allows Stored XSS.This issue affects Google Drive WP Media: from n/a through = 2.4.4...
CVE-2024-7102
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances...
AlmaLinux 9 : openssl (ALSA-2025:1330)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:1330 advisory. openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected CVE-2024-12797 Tenable has extracted the preceding description block directly from...
CVE-2025-26520
Cacti through 1.2.29 allows SQL injection in the template function in hosttemplates.php via the graphtemplate parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146...
CVE-2025-21400
CVE-2025-21400 is a Microsoft SharePoint Server remote code execution vulnerability. Connected advisories confirm affected product is SharePoint Server with RCE impact and a CVSS v3.1 base score of 8.0 (High). Patches are available: KB5002681 (SharePoint Server Subscription Edition) and KB5002685...
CVE-2025-21371
CVE-2025-21371 is a remote code execution vulnerability in Windows Telephony Service. Connected documents identify the affected component as Windows Telephony Service and annotate the CVE with a high severity (CVSS v3.1: 8.8, NETWORK attack, no privileges required, user interaction required, C/H/...
CVE-2025-24432 Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has...
RHEL 9 : kernel (RHSA-2025:1262)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1262 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: media: uvcvideo: Skip parsing frames of...
KB5051974: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (February 2025)
The remote Windows host is missing security update 5051974. It is, therefore, affected by multiple vulnerabilities - Windows Telephony Service Remote Code Execution Vulnerability CVE-2025-21190, CVE-2025-21200, CVE-2025-21371, CVE-2025-21406, CVE-2025-21407 - Microsoft Digest Authentication Remot...
Azure Linux 3.0 Security Update: avahi (CVE-2023-38469)
The version of avahi installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-38469 advisory. - A vulnerability was found in Avahi, where a reachable assertion exists in avahidnspacketappendrecord...
CVE-2024-57177
A host header injection vulnerability exists in the NPM package of perfood/couch-auth = 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information...