CVE-2025-53791

CVE-2025-53791 affects Microsoft Edge (Chromium-based). The provided data indicate an improper access control vulnerability that allows an unauthorized network attacker to bypass a security feature. The description and connected sources confirm the affected product family but do not specify affec...

CVE-2018-9382

CVE-2018-9382 affects Android Wi‑Fi service (WifiServiceImpl.java). A missing permission check can allow activating a Wi‑Fi hotspot from a non‑owner profile, enabling local privilege escalation with no extra execution privileges and no user interaction required. Public data confirms the issue is ...

CVE-2023-25153

Summary: CVE-2023-25153 affects containerd and, when importing OCI images, could allow a denial of service due to an unlimited bytes-read limit on certain files. The issue exists in versions prior to 1.6.18 and 1.5.18. Root cause: missing input size limit during image import leads to potential Do...

CVE-2022-47945

ThinkPHP Framework versions before 6.0.14 are vulnerable to local file inclusion via the lang parameter when lang_switch_on=true. An unauthenticated, remote attacker can exploit this to run arbitrary OS commands (illustrated by including pearcmd.php). Affected component: ThinkPHP language-pack/LF...

CVE-2021-3752

Mode C: CVE-2021-3752 is a Linux kernel use-after-free vulnerability in the Bluetooth L2CAP path caused by a race between connect and disconnect. The flaw can allow a local attacker to crash the system or escalate privileges. Connected documents confirm this CVE is discussed in Debian advisories ...

CVE-2018-5745

CVE-2018-5745 affects BIND's managed-keys feature, causing an assertion failure (and possible server exit) when a trust anchor is rolled over to an unsupported key algorithm. Affected: BIND 9 series (various 9.9.x–9.13.x branches and preview releases). Impact: potential denial of service by crash...

CVE-2018-20843

The CVE-2018-20843 issue affects libexpat (Expat) prior to 2.2.7, where XML inputs with many colons can cause high RAM/CPU usage and enable DoS. Related CVE-2019-15903 describes a heap-based buffer over-read when crafted XML triggers early parsing state switches. Public advisories confirm that an...

CVE-2018-9375

CVE-2018-9375 affects Google Android’s UserDictionaryProvider.java, enabling a confused deputy to add/delete words in the user dictionary and cause local privilege escalation without extra execution privileges. Public sources (Android Pixel/Nexus bulletin) list this as a local, low-ex Complexity ...

CVE-2023-30583

CVE-2023-30583 : In Node.js 20, the fs.openAsBlob() API can bypass the experimental permission model when the file system read restriction is enabled with --allow-fs-read, due to a missing check in fs.openAsBlob(). The description notes this as part of the experimental feature set. Remediation/fi...

CVE-2023-36758

CVE-2023-36758 is a Microsoft Visual Studio related elevation-of-privilege vulnerability. Public sources in the connected documents consistently describe it as a privilege-escalation issue affecting Visual Studio components (and related tooling) with an impact profile of gaining higher privileges...

CVE-2022-3509

CVE-2022-3509 concerns a parsing issue in protobuf-java (core and lite) textformat that, on inputs with multiple non-repeated embedded messages and repeated/unknown fields, can cause objects to flip between mutable/immutable forms and trigger long GC pauses, enabling a denial-of-service condition...

CVE-2021-27364

CVE-2021-27364 is a Linux kernel issue affecting the iSCSI libiscsi/iscsi subsystem (out-of-bounds read in the libiscsi module leading to possible kernel memory disclosure or crash). Connected advisories confirm related CVEs (27363, 27365) in the same area affecting sessions/handles and heap over...

CVE-2020-7676

CVE-2020-7676 is an AngularJS XSS vulnerability. AngularJS prior to 1.8.0 allows cross-site scripting due to regex-based HTML sanitization that may revert to unsanitized code; wrapping option elements in select can alter parsing and lead to unsanitized content being rendered. Connected documents ...

CVE-2020-9488

CVE-2020-9488 affects the Apache Log4j2 SMTP appender. The issue is improper validation of the SSL/TLS certificate when the host name does not match, potentially allowing a man-in-the-middle to intercept SMTPS traffic and leak log messages. The concrete remediation is to upgrade to affected relea...

CVE-2018-14333

Summary of CVE-2018-14333 (TeamViewer) : TeamViewer versions up to 13.1.1548 store a password in Unicode format inside the TeamViewer.exe process memory, between the memory delimiters [00 88] and [00 00 00]. This memory storage could let an attacker on an unattended, still-running TeamViewer sess...

CVE-2014-3214

CVE-2014-3214 affects ISC BIND prefetch in the server when a recursive nameserver is enabled (ISC BIND 9.10.0). A crafted DNS response can trigger an assertion failure and daemon exit, causing a denial of service. The NVD reports base metrics: CVSS v2 base score 5.0 (Medium) with network access a...

CVE-2013-1813

CVE-2013-1813 affects BusyBox where util-linux/mdev.c creates intermediate /dev/ directories with 0777 permissions when nesting (/dev/dir1/dir2/...), allowing local users to exploit the improper permission handling. The linked Nessus/OpenVAS entries (e.g., MiracleLinux AXSA advisory referencing B...

CVE-2012-5783

Apache Commons HttpClient 3.x (as used in Amazon FPS Java SDK and related products) is affected by CVE-2012-5783: the code does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling potential MITM spoofing with arbitrary certificates. AIX advisories,...

CVE-2025-9867

CVE-2025-9867 : The connected documents confirm a vulnerability in Google Chrome on Android before version 140.0.7339.80, described as an inappropriate implementation in Downloads that allowed a remote attacker to perform UI spoofing via a crafted HTML page. The impact is UI spoofing with a mediu...

CVE-2024-57378

CVE-2024-57378 affects Wazuh SIEM 4.8.2. A broken access control allows unauthorized creation of internal users without an existing role, enabling potential privilege escalation or access to sensitive resources. Documents confirm the issue and its impact but do not specify a fixed version or patc...

CVE-2024-31449

CVE-2024-31449 affects Redis with Lua scripting. An authenticated user can trigger a stack overflow in the Lua bit library via a crafted script, potentially enabling remote code execution. The issue affects all Redis versions that support Lua scripting and is fixed in Redis 6.2.16, 7.2.6, and 7.4...

CVE-2023-1829

CVE-2023-1829 affects the Linux kernel tcindex subsystem. A use-after-free can occur in tcindex_delete when filters are not properly deactivated for a perfect-hash underlying structure, potentially enabling local privilege escalation to root. The flaw is tied to the traffic control index filter (...

CVE-2022-0801

CVE-2022-0801 describes an issue in Google Chrome’s HTML parser where an improper implementation could bypass XSS protections via a crafted HTML page. Affected product: Google Chrome (via Chromium codebase). Root cause: insecure HTML parsing logic preceding version 99.0.4844.51. Impact: remote at...

CVE-2020-3345

Cisco Webex Meetings and Webex Meetings Server are affected by CVE-2020-3345, an HTML injection vulnerability rooted in improper parameter validation on web pages. An unauthenticated, remote attacker can entice a user to follow a crafted link that injects HTML into an affected parameter, enabling...

CVE-2025-59798

Artifex Ghostscript

CVE-2024-9143

CVE-2024-9143 describes a vulnerability in OpenSSL: using low-level GF(2^m) ECC APIs with untrusted explicit field-polynomial values can cause out-of-bounds memory reads/writes, potentially crashing an application or enabling remote code execution. Affected are APIs like EC_GROUP_new_curve_GF2m()...

CVE-2023-5090

CVE-2023-5090: A flaw in Linux kernel KVM (svm_set_x2apic_msr_interception) enables direct access to host x2apic MSRs when a guest resets its APIC, potentially causing denial of service. Connected advisories (Astra Linux, IBM Guardium bulletin, Amazon ALAS) reference this CVE as part of Linux ker...

CVE-2023-36801

Technical details for CVE-2023-36801 are not provided in the supplied documents. No explicit affected product/version, root cause, impact, or remediation are specified here. Monitor for updates from official sources.

CVE-2023-29349

CVE-2023-29349 concerns Microsoft ODBC and OLE DB components (SQL Server ODBC Driver and OLE DB Driver) enabling remote code execution. The vulnerability arises from improper handling in the ODBC/OLE DB stack, with an attack vector described as LOCAL and requiring user interaction, resulting in h...

CVE-2023-23752

CVE-2023-23752 affects Joomla! 4.0.0–4.2.7, where an improper access check on webservice endpoints allows unauthenticated access, enabling information disclosure. Exploit PoCs in public repos demonstrate unauthenticated disclosure against Joomla! 4.2.8 in some cases. Root cause: insufficient auth...

CVE-2023-23454

CVE-2023-23454 affects the Linux kernel cbq_classify (net/sched/sch_cbq.c) up to version 6.1.4, enabling a local attacker to trigger a slab-out-of-bounds read via type confusion (non-negative values may be misinterpreted as TC_ACT_SHOT), causing denial of service. Connected advisories reference s...

CVE-2022-41881

Netty CVE-2022-41881 concerns a StackOverflowError when parsing malformed crafted messages due to infinite recursion in the HAProxyMessageDecoder. The issue affects Netty versions before 4.1.86.Final and can lead to denial of service through resource exhaustion. The vulnerability is fixed in 4.1....

CVE-2022-3190

The CVE describes an infinite loop in the F5 Ethernet Trailer protocol dissector of Wireshark. Affected releases include Wireshark 3.6.0–3.6.7 and 3.4.0–3.4.15, where processing crafted captures or packet injections can cause a denial of service. Connected advisories corroborate the issue and ind...

CVE-2022-31000

The CVE concerns solidus_backend, the admin interface of the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 are affected by a cross-site request forgery (CSRF) that lets an attacker change the state of an order’s adjustments if they know the order number, with the actio...

CVE-2021-28651

Concrete details found for CVE-2021-28651 in multiple advisories. Affected software: Squid proxy (versions before 4.15 and 5.x before 5.0.6). Root cause: a buffer-management/memory handling issue in the urn: scheme parsing leading to a memory leak; an attack path exists that can trigger large mem...

CVE-2020-8648

CVE-2020-8648 is a use-after-free in the Linux kernel’s n_tty_receive_buf_common function (drivers/tty/n_tty.c), affecting kernel builds up to 5.5.2. It is a local vulnerability; exploitation could crash the kernel (DoS), with CVSS notes indicating local access and high impact on availability. Co...

CVE-2019-18874

CVE-2019-18874 affects the Python module psutil (python-psutil). The issue is a double free caused by refcount mishandling in loops that convert system data into Python objects, as reported up to version 5.6.5 (and referenced in later advisories noting fixes in newer releases). Connected sources ...

CVE-2019-13057

CVE-2019-13057 affects Cloud Pak for Security (CP4S) via OpenLDAP openldap server delegation: slapd may allow a rootDN (database admin) to be granted authorization as an identity from another database during SASL bind or RFC 4370 proxyAuthz control, enabling potential leakage of sensitive informa...

CVE-2018-10903

The CVE-2018-10903 issue affects python-cryptography versions >=1.9.0 and

CVE-2016-5636

CVE-2016-5636 describes an integer overflow/heap-based buffer overflow in Python’s zipimporter (zipimport.c get_data). It affects CPython before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2, exploitable via a negative data size value in a crafted zip file loaded during import. The connected d...

CVE-2013-2028

The CVE-2013-2028 issue affects nginx 1.3.9–1.4.0, where the ngx_http_parse_chunked function mishandles large chunk sizes in chunked Transfer-Encoding. The root cause is an integer signedness error that leads to a stack-based buffer overflow, enabling remote denial of service and potential code e...

CVE-2023-27113

CVE-2023-27113 affects pearProjectApi v2.8.10, with a SQL injection vulnerability in project.php reachable via the organizationCode parameter. The issue’s root cause is a SQL injection in that parameter, exposing potential impacts to confidentiality, integrity, and availability as reflected by CV...

CVE-2021-46937

The connected Nessus entry confirms CVE-2021-46937 affects the Linux kernel DAMON debugfs interface: repeated writes to the target_ids file increase pid reference counts without corresponding decreases, causing a memory leak of struct pid. The issue is fixed by a kernel patch that decrements PID ...

CVE-2023-4692

Concretely documented: CVE-2023-4692 is an out-of-bounds write in grub2’s NTFS driver that can corrupt heap metadata, potentially enabling arbitrary code execution and secure-boot protection bypass. Several connected advisories (e.g., CBL-Mariner) note that a patched grub2 is available; affected ...

CVE-2023-44488

CVE-2023-44488 affects VP9 in libvpx prior to 1.13.1, where widths are mishandled during encoding, causing a crash. The CVE is documented across multiple sources including the libvpx 1.13.1 release and related advisories (e.g., ALAS2-2025-2960, CBLMariner). The issue is tied to libvpx’s handling ...

CVE-2022-22756

CVE-2022-22756 describes a drag-and-drop image object that could be turned into an executable script, enabling arbitrary code execution when clicked. Affected products and versions include Firefox <97, Thunderbird <91.6, and Firefox ESR

CVE-2022-35520

CVE-2022-35520 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 where the api.cgi component does not filter the hidden ufconf parameter, which exists in the CGI binary but not in POST data, enabling command injection on the /ledonoff.shtml page. Public references in the connected ...

CVE-2022-35737

CVE-2022-35737 affects SQLite, with vulnerable versions 1.0.12–3.39.x, before 3.39.2. The issue is an array-bounds overflow triggered by very large string arguments to a C API, which can cause a crash and, in some advisories, potentially allow arbitrary code execution. The documented fix is to up...

CVE-2020-28015

Exim 4 before 4.94.2 is affected by CVE-2020-28015 due to Improper Neutralization of Line Delimiters. A local attacker can abuse newline characters in recipient addresses to alter the behavior of root processes. Affected product: Exim (MTA). Root cause: newline handling in recipient address enabl...

CVE-2021-21290

CVE-2021-21290 relates to Netty before 4.1.59.Final, where an insecure temp file in Unix-like systems could lead to local information disclosure when uploads are stored on disk via multipart decoders. The Unix temp dir is shared among users, and files created with File.createTempFile may have ins...