CVE-2022-20863

Cisco Webex App (formerly Webex Teams) contains a vulnerability in its messaging interface that could allow an unauthenticated, remote attacker to manipulate displayed links or content by exploiting improper handling of character rendering. The issue arises when messages are processed in the inte...

CVE-2026-6366

CVE-2026-6366 — Drupal core insecure gadget chain leading to object injection Affects Drupal core: 8.0.0–10.5.8, 10.6.0–10.6.6, 11.0.0–11.2.10, 11.3.0–11.3.7. The issue is an improperly controlled modification of dynamically-determined object attributes that enables a gadget chain when deserializ...

CVE-2021-35464

CVE-2021-35464 affects ForgeRock OpenAM/Access Management: Java deserialization in the JATO framework allows pre-auth remote code execution on ForgeRock AM Core Server when running versions prior to 7.0. An attacker can trigger RCE by sending a crafted HTTP request to endpoints like /ccversion/Ve...

CVE-2019-17558

CVE-2019-17558 affects Apache Solr 5.0.0–8.3.1 and allows remote code execution via the VelocityResponseWriter. An attacker can supply a Velocity template through configset velocity/ or via a parameter; enabling the resource loader for templates requires a configured response writer. Solr 8.4 rem...

CVE-2003-1418

CVE-2003-1418 affects Apache HTTP Server 1.3.22–1.3.27 on OpenBSD. The root cause is information disclosure via (1) ETag headers that reveal inode numbers and (2) multipart MIME boundaries that reveal child process IDs (PIDs). Practical impact is partial information disclosure that can aid reconn...

CVE-2011-3544

CVE-2011-3544 is a vulnerability in the Java scripting engine where untrusted code (e.g., applets) could elevate privileges due to missing security manager checks. Affected: Oracle Java SE/JDK/JRE 6 and 7 up to update 27 and earlier. Impact reported as remote arbitrary code execution/elevation of...

CVE-2019-8720

CVE-2019-8720 is a WebKit-based memory-corruption vulnerability affecting WebKitGTK/WebKit2GTK components. Public sources in the Connected Documents identify arbitrary-code-execution potential when processing malicious web content (WebKitGTK/WebKit2GTK). Debian’s security advisory lists CVE-2019-...

CVE-2019-1322

CVE-2019-1322 is a Windows local privilege escalation vulnerability, arising from improper handling of authentication requests that can allow an attacker to execute with SYSTEM privileges. Public references and connected items show explicit exploitation tooling and modules (e.g., COMahawk and Ere...

CVE-2016-0167

CVE-2016-0167 is a Windows kernel-mode Win32k Privilege Escalation vulnerability affecting multiple OS versions (e.g., Vista SP2, Windows 7 SP1, Windows 8.1, Windows Server 2008/R2, Windows 10). The issue arises in the kernel-mode driver Win32k where a crafted application can escalate privileges ...

CVE-2021-21148

CVE-2021-21148 is a heap buffer overflow in the V8 engine of Google Chrome/Chromium up to version 88.0.4324.150, enabling a remote attacker to potentially corrupt the heap via a crafted HTML page. Connected advisories confirm this affects Chromium-based browsers and note public fixes: Debian repo...

CVE-2016-3115

OpenSSH CVE-2016-3115 affects sshd in OpenSSH prior to 7.2p2. The vulnerability arises from CRLF injection via crafted X11 forwarding data in session.c (related to do_authenticated1 and session_x11_req), allowing a remote authenticated user to bypass shell-command restrictions. In practice, affec...

CVE-2012-0507

CVE-2012-0507 affects Oracle Java SE/JRE (7u2 and earlier, 6u30 and earlier, 5.0u33 and earlier). Root cause: AtomicReferenceArray may not enforce Object[] type, enabling type confusion. Impacts include potential sandbox breach and JVM crash; remote code execution is discussed in related advisori...

CVE-2024-57884

Technical details about CVE-2024-57884 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2021-25746

CVE-2021-25746 affects the ingress-nginx controller. A user who can create or update Ingress objects can read the controller’s credentials by manipulating .metadata.annotations in an Ingress (networking.k8s.io or extensions API group). In the default configuration, those credentials grant access ...

CVE-2020-7463

CVE-2020-7463 is a FreeBSD kernel use-after-free vulnerability caused by improper handling of large user messages from multiple threads on the same SCTP socket. Affected: FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEA...

CVE-2014-6332

CVE-2014-6332 is discussed in connected sources as being exploited by the Neptune Exploit Kit to deliver a Monero-mining payload via Internet Explorer exploits. The Neptune Campaign uses CVE-2014-6332 alongside other IE and Flash exploits to identify vulnerable targets and chain exploits in a sin...

CVE-2021-43159

CVE-2021-43159 affects Ruijie Networks RG-EW Series Routers (up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55). The vulnerability arises via the setSessionTime function in /cgi-bin/luci/api/common, enabling Remote Code Execution (RCE). CVSS metrics show a high-severity issue (CVSS v3.1 base score 8.8; n...

CVE-2021-30860

CVE-2021-30860 affects Apple CoreGraphics in macOS/iOS/watchOS/tvOS stack. A vulnerability in integer overflow during processing of maliciously crafted PDFs could lead to arbitrary code execution. Fixed in Security Update 2021-005 for Catalina, iOS 14.8 / iPadOS 14.8, macOS Big Sur 11.6, and watc...

CVE-2008-1279

Summary: CVE-2008-1279 affects Acronis True Image Group Server 1.5.19.191 and earlier (included in Acronis True Image Enterprise Server 9.5.0.8072 and other True Image packages). The issue is an out-of-bounds read triggered by a packet with an invalid length field, leading to remote denial of ser...

CVE-2023-45286

CVE-2023-45286 concerns a race condition in the Go HTTP client library go-resty/resty/v2. When request retries are enabled, calling sync.Pool.Put on the same bytes.Buffer more than once may yield a buffer that hasn’t been Reset, causing the HTTP request body from a prior request to be appended to...

CVE-2021-25631

CVE-2021-25631 affects LibreOffice 7-1 (before 7.1.2) and 7-0 (before 7.0.5). The issue allows bypassing the denylist by manipulating a link so it no longer matches the denylist but triggers ShellExecute to launch an executable type, enabling arbitrary code execution under Windows. Affected produ...

CVE-2022-22674

CVE-2022-22674 involves an out-of-bounds read in the Intel Graphics Driver on macOS, allowing a local attacker to read kernel memory. Apple fixed it with patches in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, and macOS Big Sur 11.6.6 by improving input validation/bounds checks. Ther...

CVE-2017-0146

CVE-2017-0146 is a Windows SMBv1 server remote code execution vulnerability. The description specifies that the SMBv1 server in affected Windows editions allows remote attackers to execute arbitrary code via crafted packets. Affected products include Windows Vista SP2; Windows Server 2008 SP2 and...

CVE-2012-4681

CVE-2012-4681 affects Oracle Java SE 7 (JRE) up to Update 6, and earlier; vulnerability chain bypasses SecurityManager via beans permission checks and restricted package access, using ClassFinder.findClass and reflection with a trusted immediate caller to reach private fields. Exploitation in the...

CVE-2022-37434

CVE-2022-37434 describes a heap-based buffer over-read/overflow in zlib’s inflate() (inflate.c) when handling a large gzip header extra field. The vulnerability is limited to code paths that call inflateGetHeader, and is fixed in subsequent zlib revisions. Connected advisories indicate affected e...

CVE-2012-1856

CVE-2012-1856 covers a remote code execution vulnerability in the TabStrip ActiveX control (MSCOMCTL.OCX) used by multiple Microsoft Office components and related products. The issue arises from a system-state corruption triggered by crafted (1) documents or (2) web pages, allowing remote attacke...

CVE-2023-38831

CVE-2023-38831 affects WinRAR prior to 6.23. A crafted ZIP can trigger code execution when a user views a benign file, because a folder with the same name as that file may be processed during access. This vulnerability enables remote or local code execution depending on the user’s interaction wit...

CVE-2019-7609

Kibana Timelion Remote Code Execution (CVE-2019-7609): A flaw in Timelion allowed an attacker with access to the Timelion application to send a request that may execute JavaScript code, potentially yielding arbitrary commands with Kibana process privileges on the host. Affected versions are Kiban...

CVE-2022-0934

CVE-2022-0934 affects dnsmasq with a single-byte, non-arbitrary write/use-after-free flaw in the DHCPv6 path (dhcp6_no_relay) that can lead to denial of service when processing crafted packets. Public advisories in connected documents confirm the issue and reference fixes in vendor/security updat...

CVE-2017-0147

CVE-2017-0147 affects the SMBv1 server in multiple Windows platforms, where remote attackers can obtain sensitive information from process memory via crafted SMB packets. Affected products include Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012, ...

CVE-2026-6365

CVE-2026-6365 is an XSS vulnerability in Drupal core caused by improper neutralization of input during web page generation. Affects Drupal core versions: 8.0.0–before 10.5.9, 10.6.0–before 10.6.7, 11.0.0–before 11.2.11, 11.3.0–before 11.3.7. The issue relates to Drupal core’s jQuery integration f...

CVE-2023-52469

CVE-2023-52469 : The Linux kernel vulnerability resides in drivers/amd/pm where a use-after-free occurs in kv_parse_power_table. When kzalloc returns NULL, kv_parse_power_table frees adev->pm.dpm.ps and the object is then (incorrectly) used in kv_dpm_fini, causing a use-after-free. This is doc...

CVE-2020-3182

Cisco Webex Meetings Client for MacOS is affected by an information-disclosure vulnerability in the mDNS configuration. An unauthenticated adjacent attacker can exploit this by issuing an mDNS query for a specific service to obtain device information from affected Webex clients. The issue is docu...

CVE-2007-2768

OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, can leak whether a target user exists by returning different responses if the account is configured for OTP. This is described for CVE-2007-2768 (OpenSSH 4.6 and earlier) and is related to CVE-2007-2243 in the IBM bulletin, whic...

CVE-2023-22809

CVE-2023-22809 affects sudo prior to 1.9.12p2, where the sudoedit (-e) feature mishandles extra arguments passed via environment variables SUDO_EDITOR, VISUAL, and EDITOR. This allows a local attacker to append arbitrary entries to the list of files to process, enabling privilege escalation. The ...

CVE-2020-13699

CVE-2020-13699 affects TeamViewer Desktop for Windows prior to 15.8.3, due to unquoted custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters (example: teamviewer10: --play URL), causing the victim to issue an NTLM authentication request that could be relayed o...

CVE-2021-22986

CVE-2021-22986 affects F5 BIG-IP iControl REST, allowing unauthenticated remote command execution. Affected software ranges include BIG-IP 16.0.0–16.0.1 (before 16.0.1.1), 15.1.x (before 15.1.2.1), 14.1.x (before 14.1.4), 13.1.x (before 13.1.3.6), 12.1.x (before 12.1.5.3), and BIG-IQ 7.1.0.x (bef...

CVE-2024-33869

Artifex Ghostscript

CVE-2023-52470

CVE-2023-52470: Linux kernel vulnerability fixed in drm/radeon driver. The issue was a potential NULL pointer dereference in radeon_crtc_init() if the alloc_workqueue call failed. The published fix adds a check for the alloc_workqueue return value to avoid dereferencing a NULL pointer. Affected c...

CVE-2021-36769

CVE-2021-36769 describes a reordering issue in Telegram that allows an attacker to cause a server to receive messages in a different order than sent. Affected products/versions include Telegram for Android prior to 7.8.1, Telegram for iOS prior to 7.8.3, and Telegram Desktop prior to 2.8.8. The i...

CVE-2019-8506

CVE-2019-8506 is a type-confusion memory issue that affects WebKit components and was fixed in multiple Apple platforms (iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes/Windows, iCloud for Windows 7.11) and WebKitGTK/WebKitGTK+ up to 2.28.x. The vulnerability can allow arbitrary code execut...

CVE-2018-2628

Oracle WebLogic Server (WLS Core Components) is affected in versions 10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3. The vulnerability is a deserialization RCE over the T3/JRMP interface that allows an unauthenticated remote attacker to take over the server. Public exploits exist (Exploit-DB entries ...

CVE-2025-23048

Affected software: Apache HTTP Server (httpd). CVE-2025-23048 describes an access-control bypass in mod_ssl when TLS 1.3 session resumption is used in configurations with multiple virtual hosts, each with different trusted client certificates; a client trusted for one vhost could access another i...

CVE-2022-20701

CVE-2022-20701 discusses multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Affected components include the SSL VPN module and the web-based management interface, with issues in image verification. Consequences stated across sources include remote code...

CVE-2021-21206

CVE-2021-21206 is a use-after-free in Blink (Chrome) leading to potential heap corruption via a crafted HTML page. Affected product: Google Chrome (Blink engine). Root cause: use-after-free in rendering engine prior to 89.0.4389.128. Impact per sources: high severity with network attack vector, u...

CVE-2021-22005

CVE-2021-22005 affects VMware vCenter Server via an arbitrary file upload vulnerability in the Analytics service. With network access to port 443, an attacker can upload a crafted file to trigger remote code execution. Public PoCs and exploits exist (e.g., VM attack surfaces and multiple advisori...

CVE-2020-10189

CVE-2020-10189 affects Zoho ManageEngine Desktop Central prior to build 10.0.474, enabling unauthenticated remote code execution via deserialization of untrusted data in FileStorage.getChartImage related to CewolfServlet/MDMLogUploaderServlet. Connected reports confirm real-world exploitation (e....

CVE-2017-1000486

CVE-2017-1000486 affects Primetek Primefaces 5.x, with a weak encryption flaw enabling remote code execution. Public details describe a padding oracle issue exploited by attackers; Primefaces versions prior to 5.2.21, 5.3.8, or 6.0 are noted as vulnerable, with patches implied for those lines. Pu...

CVE-2019-10910

CVE-2019-10910 affects Symfony versions prior to fixed releases: Symfony 2.7.51+, 2.8.50+, 3.x 3.4.26+, 4.x 4.1.12+, and 4.2.x 4.2.7+. The issue arises when service IDs can be influenced by user input, allowing SQL injection and remote code execution via the dependency-injection component. Mitiga...

CVE-2015-1427

CVE-2015-1427 concerns Elasticsearch’s Groovy scripting engine, where dynamic scripting was enabled by default in versions before 1.3.8 (and 1.4.x before 1.4.3). The root cause is a sandbox bypass in the Groovy sandbox that allows remote attackers to execute arbitrary shell commands via a crafted...