CVE-2022-30746

Summary: CVE-2022-30746 affects Samsung SmartThings prior to 1.7.85.12. A missing caller check in the JavaScript interface API can allow a remote attacker to access sensitive information. The vulnerability is described across multiple sources (NVD, Red Hat, CNVD/CNNVD references) as a missing cal...

CVE-2022-21662

CVE-2022-21662 affects WordPress core; vulnerability allows low-privileged authenticated users (e.g., authors) to execute JavaScript via stored XSS, potentially impacting high-privilege users. It has been patched in WordPress 5.8.3, with older affected versions fixed via security releases back to...

CVE-2019-10172

CVE-2019-10172 describes an XML External Entity (XXE) vulnerability in org.codehaus.jackson:jackson-mapper-asl:1.9.x (Codehaus Jackson). Connected sources confirm the flaw affecting jackson-mapper-asl libraries and note that CVE-2016-3720 affects related code, in different classes. Public advisor...

CVE-2019-1003000

CVE-2019-1003000 is a sandbox bypass/remote code execution flaw in Jenkins via the Script Security Plugin (and depending on Groovy/Declarative plugins). Affected components include Script Security Plugin versions up to 1.49 and earlier, with vulnerable code in GroovySandbox.java that lets attacke...

CVE-2018-16042

CVE-2018-16042 is a security bypass affecting Adobe Acrobat and Reader versions listed (2019.008.20081/20080, 2017.011.30106/30105, 2015.006.30457/30456, and related builds). The vulnerability’s impact is information disclosure if exploited. The provided sources indicate a bypass issue without de...

CVE-2010-2068

CVE-2010-2068 affects Apache HTTP ServerAffected: mod_proxy_http.c in Apache HTTP Server 2.2.9–2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, OS/2 in certain proxy worker pool configurations.Root cause: timeout handling in mod_proxy_http did not correctly detect timeouts, allowing a re...

CVE-2023-26369

Adobe Acrobat/Reader CVE-2023-26369 is an out-of-bounds write vulnerability that can enable arbitrary code execution in the context of the current user. Affected are Acrobat Reader 23.003.20284 and earlier, 20.005.30516 and earlier, and 20.005.30514 and earlier. Exploitation requires user interac...

CVE-2023-29400

CVE-2023-29400 corresponds to a Go/golang vulnerability in html/template: improper handling of empty HTML attributes (e.g., attr={{.}}). The connected advisories confirm the issue affects Go toolchain templates and is being tracked across multiple Linux distributions (e.g., Mariner golang package...

CVE-2022-3996

CVE-2022-3996 describes an OpenSSL policy-contraint processing issue where a malformed certificate policy can trigger a write lock to be taken recursively, enabling DoS for affected processes. The vulnerability is tied to OpenSSL policy checks and the use of policy processing via -policy or X509_...

CVE-2022-28811

CVE-2022-28811 affects Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server 2.8.3. The vulnerability stems from improper input validation on an API-submitted parameter, enabling a remote, unauthenticated attacker to execute arbitrary OS commands. The CVSS score is 9.8 (Critical) with ...

CVE-2020-25705

CVE-2020-25705 is a Linux kernel ICMP handling flaw that lets an off-path attacker bypass UDP source port randomization and rapidly scan open UDP ports. Affected products include various kernel versions and embedded/Linux-based devices; remediation is via kernel updates (e.g., CentOS/AlmaLinux ad...

CVE-2019-10906

CVE-2019-10906 affects Pallets Jinja2 before 2.10.1. The vulnerability arises from str.format_map allowing a sandbox escape, enabling potentially untrusted template code to escape sandbox restrictions. The issue is blocked to Jinja2’s sandboxed evaluation and affects environments using Pallets Ji...

CVE-2025-12818

CVE-2025-12818 is a vulnerability in the PostgreSQL libpq client library caused by integer wraparound that under-sizes allocations, leading to out-of-bounds writes and application segfaults. Affected are libpq-related code in PostgreSQL client libraries prior to fixed versions. Public references ...

CVE-2021-46952

Summary (CVE-2021-46952): In the Linux kernel, NFS with UDP transport was vulnerable to a shift-out-of-bounds due to a garbage UDP retrans timeout being passed to xprt_calc_majortimeo. If retrans is >= 64, the mount fails with an error, preventing exploitation. The fix is a patch to validate U...

CVE-2023-22079

CVE-2023-22079 concerns Oracle MySQL Server, component Server: Optimizer. Affected: MySQL 8.0.34 and earlier. Description: a low-privileged, network-accessible attacker can cause the MySQL Server to hang or crash (complete DoS) via multiple protocols. CVSS v3.1 base score 6.5 (Availability HIGH; ...

CVE-2022-28734

CVE-2022-28734 is an out-of-bounds write in grub2 related to handling split HTTP headers. The root cause is that grub2’s HTTP parsing moves an internal buffer pointer by one position when processing split headers, which can lead to writing a NULL byte past the buffer and corrupt memory metadata. ...

CVE-2023-25717

CVE-2023-25717 affects Ruckus Wireless Admin panels (10.4 and earlier) across Ruckus ZoneDirector, SmartZone, and Solo APs where the web services component is enabled. The vulnerability enables unauthenticated remote code execution via an unauthenticated HTTP GET request (example parameterized lo...

CVE-2022-26669

ASUS Control Center is affected by CVE-2022-26669: an authenticated remote attacker with general user privilege can inject SQL commands into specific API parameters to obtain database schema or access data. The vulnerability is documented in NVD/CNVD/CNNVD entries and related lists; exploitation ...

CVE-2020-7608

CVE-2020-7608 affects the yargs-parser package and enables prototype pollution via a proto payload, allowing modification of Object.prototype. Public data notes local/remote impact depending on the environment, with CVSS vectors indicating low-to-medium base severity (NVD CVSS v3.1: 5.3, LOCAL, L...

CVE-2024-56325

Apache Pinot

CVE-2021-33990

Liferay Portal 6.2.5 is reported vulnerable to an insecure permissions issue that allows a Command=FileUpload&Type=File&CurrentFolder=/ request when frmfolders.html exists. The CVE-2021-33990 entries (NVD/Red Hat/CVE List) describe this as an improper privilege/permission scenario, with high risk...

CVE-2022-28285

CVE-2022-28285 describes an incorrect AliasSet used during MLoadTypedArrayElementHole JIT codegen, enabling a potential out-of-bounds read when combined with another vulnerability. Affected products include Thunderbird < 91.8, Firefox < 99, and Firefox ESR

CVE-2022-40897

CVE-2022-40897 affects Python setuptools (PyPA) prior to 65.5.1, enabling a Regular Expression Denial of Service (ReDoS) via HTML in crafted PackageIndex content (package_index.py). Affected component is setuptools; impact is DoS with potential availability disruption. Remediation shown across mu...

CVE-2022-35252

CVE-2022-35252 affects curl’s handling of cookies containing control codes; when such cookies are echoed back to a server, the server may return 400 responses, effectively enabling a “sister site” to deny service to other siblings. Public advisories confirm this is fixed in curl updates across se...

CVE-2018-1050

CVE-2018-1050 is a NULL pointer dereference in Samba’s RPC external printer service that can crash the print spooler, affecting Samba releases from 4.0.0 onward. The issue arises from missing input validation in spoolss RPC calls, leading to a denial-of-service condition. Public advisories and pr...

CVE-2026-44815

CVE-2026-44815 is a stack-based buffer overflow in the Windows DHCP Client that enables remote code execution over the network. Affected component: Windows DHCP Client; root cause is a stack-based overflow. Consequences are remote code execution with high impact, as indicated by the CVSS vector (...

CVE-2025-67642

The CVE-2025-67642 affects the Jenkins HashiCorp Vault Plugin versions 371.v884a_4dd60fb_6 and earlier. Root cause: the plugin does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials t...

CVE-2023-39742

CVE-2023-39742 affects giflib v5.2.1, with a segmentation fault in getarg.c identified as the root cause. Several connected advisories confirm the issue across distributions (Amazon Linux, Fedora, Alpine, Mariner), noting patched/updated packages are available (e.g., giflib and related utilities/...

CVE-2020-36024

CVE-2020-36024 affects freedesktop poppler, specifically version 20.12.1, where a NULL pointer dereference in FoFiType1C::convertToType1 can be exploited via a crafted PDF to trigger denial of service. The connected sources (MiracleLinux, Unity Linux, Debian, Rocky Linux, etc.) cite this vulnerab...

CVE-2023-2801

Grafana (CVE-2023-2801) is affected by a vulnerability allowing a crash via mixed data-source queries in public dashboards or when calling the query API directly. The issue is tied to Grafana’s handling of mixed queries and could impact availability of the Grafana instance. Fixed versions per the...

CVE-2022-31004

CVE-2022-31004 affects the open source CVE services API project cve-services. A conditional in data.js can cause the generated randomKey to be written to disk when not running in development, potentially exposing plaintext secrets on disk in production. Public details do not list a released patch...

CVE-2022-29253

The CVE-2022-29253 entries describe a path traversal in XWiki Platform. Affected versions are 8.3-rc-1 up to but not including 13.10.3 and 14.0 (i.e., versions prior to 12.10.3 and 14.0 are affected). The root cause is the template API allowing a path containing ".." to access files located in th...

CVE-2025-48593

The CVE-2025-48593 entry concerns a remote code execution flaw in Android’s system code, specifically within the bta_hf_client_main.cc path (bta_hf_client_cb_init). The root cause is a missing bounds check during processing of network packets, enabling a buffer overflow via memcpy into a fixed-si...

CVE-2024-57790

CVE-2024-57790 affects IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0. A hardcoded root credential stored in non-volatile flash enables physically proximate attackers to obtain root access via UART or SSH. The vulnerability is categorized with physical attack vector, low authentication,...

CVE-2025-22968

Affected product: D-Link DWR-M972V (firmware 1.05SSG). Vulnerability enables a remote attacker to execute arbitrary code via SSH as root without restrictions. Root-privileged code execution stems from the SSH implementation/firmware logic as described in multiple sources. No exploitation details ...

CVE-2024-21096

Technical details about CVE-2024-21096 are not publicly provided in the supplied documents. Monitoring for updates is advised; the current sources do not specify affected products, versions, exploitability, or remediation within the given materials.

CVE-2020-29594

CVE-2020-29594 affects Rocket.Chat (varying branches: before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, 3.9.x before 3.9.1) and is caused by mishandling of SAML login. The connected HackerOne report documents an unauthenticated bypass via the addSamlProvide...

CVE-2025-38236

CVE-2025-38236 concerns a Linux kernel af_unix use-after-free involving consecutive consumed OOB skbs in unix_stream_read_generic(), triggered when OOB data is read but the corresponding skb remains on the recv queue. The root cause is the handling of consumed OOB skbs and the SO_PEEK_OFF path, w...

CVE-2025-21877

CVE-2025-21877 (Linux kernel, usbnet gl620a) affects the usbnet implementation in the kernel where GenelInK_bind() fails to verify that the device actually provides the endpoints it requests. This can lead to a mismatch when an artificially manufactured endpoint is encountered, as Syzbot observed...

CVE-2022-28771

SAP Business One License service API (version 10.0) is affected by a vulnerability caused by a missing authentication check. The issue allows an unauthenticated, remote attacker to send malicious HTTP requests over the network, potentially breaking the whole application and making it inaccessible...

CVE-2020-14812

CVE-2020-14812 affects Oracle MySQL Server (component: Server: Locking) with affected versions 5.6.49 and prior, 5.7.31 and prior, and 8.0.21 and prior. Exploitation can lead to a hang or frequent crashes (DoS) with network access. Remediation status varies by distribution; Debian LTS notes a fix...

CVE-2020-15358

CVE-2020-15358 (SQLite) affects the SQLite library, specifically the query engine path in select.c where the query-flattener optimization mishandles constant propagation for multiSelectOrderBy. The root cause is a mishandling of transitive properties during constant propagation, leading to a heap...

CVE-2017-18640

CVE-2017-18640 affects SnakeYAML; the vulnerability arises from entity expansion (Billion Laughs style) during load, allowing abuse of the alias feature. Affected versions are before 1.26 (e.g., SnakeYAML 1.25.x onward) with public mentions in multiple advisories showing a fix in 1.26. Fedora/Alm...

CVE-2018-21028

CVE-2018-21028 affects Boa up to 0.94.14rc21; memory leak caused by missing calls to free. Descriptions from NVD/UBU/etc. indicate remote attackers could trigger the leak, but there is no explicit exploit/wild status provided in the connected documents. Remediation/fixes are not detailed in the s...

CVE-2010-4007

Oracle Mojarra is affected by CVE-2010-4007 due to an encrypted View State without a Message Authentication Code (MAC), enabling a padding oracle attack to modify the View State remotely. This weakness is reiterated across multiple sources (NVD, Red Hat advisory, and other feeds) and is tied to M...

CVE-2025-66200

CVE-2025-66200 affects Apache HTTP Server 2.4.7–2.4.65. A mod_userdir+suexec bypass via AllowOverride FileInfo lets users with htaccess access to the RequestHeader directive cause some CGI scripts to execute under an unexpected userid. Connected advisories confirm the fix is in 2.4.66 (e.g., Debi...

CVE-2023-22527

CVE-2023-22527 is an OGNL/SSTI-based remote code execution vulnerability in Atlassian Confluence Data Center and Server. Affected versions include Confluence Data Center/Server 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0–8.5.3 (per multiple exploits). Anonymous attackers could trigger RCE via a ...

CVE-2023-22064

CVE-2023-22064 affects Oracle MySQL Server (Server: Optimizer) with affected versions 8.0.34 and earlier. The vulnerability allows a high-privilege attacker with network access via multiple protocols to cause a hang or repeatable crash (a complete DoS) of MySQL Server; CVSS v3.1 base score 4.9 (A...

CVE-2023-26818

CVE-2023-26818 affects Telegram versions 9.3.1–9.4.0. The issue is a macOS/ DYLD_INSERT_LIBRARIES–related access control flaw that can allow an attacker to read restricted files, microphone, or video recordings. Connected sources confirm the presence of the vulnerability in Telegram and describe ...

CVE-2022-41854

CVE-2022-41854: Denial of Service in Snakeyaml when parsing untrusted YAML, potentially via stack overflow causing availability impact. Affected component: Snakeyaml (Java); exact affected versions not clearly specified in the provided documents, but references discuss Snakeyaml usage and updates...