CVE-2025-53799

CVE-2025-53799 affects the Windows Imaging Component. The vulnerability arises from use of an uninitialized resource in Imaging Component code, enabling local attackers to disclose information. The NCSC entry confirms the impact as Access to sensitive data with a CVSS-like rating around 5.5 (Medi...

CVE-2024-21096

Technical details about CVE-2024-21096 are not publicly provided in the supplied documents. Monitoring for updates is advised; the current sources do not specify affected products, versions, exploitability, or remediation within the given materials.

CVE-2023-46136

CVE-2023-46136 affects Werkzeug (WSGI library). A crafted multipart upload starting with CR/LF followed by many data bytes can cause the parser to append to an internal buffer and exhaust CPU, leading to DoS. This has been patched in version 3.0.1. IBM/PowerVC and QRadar bulletins referencing the...

CVE-2022-26387

The CVE-2022-26387 issue is a Mozilla add-on verification weakness. A time-of-check/time-of-use (TOCTOU) bug could allow the add-on file to be altered after Firefox/Thunderbird signatures were checked but before user confirmation, leaving the user exposed. Affected products and versions per conne...

CVE-2022-26669

ASUS Control Center is affected by CVE-2022-26669: an authenticated remote attacker with general user privilege can inject SQL commands into specific API parameters to obtain database schema or access data. The vulnerability is documented in NVD/CNVD/CNNVD entries and related lists; exploitation ...

CVE-2019-14889

The CVE-2019-14889 flaw affects libssh where the API function ssh_scp_new() can be misused when the third parameter is user-controlled. Versions before 0.9.3 and before 0.8.8 are vulnerable: during SCP client-server interaction the server may execute a scp command that includes a user-provided pa...

CVE-2026-33825

CVE-2026-33825 is a local EoP vulnerability in the Microsoft Defender Antimalware Platform. A TOCTOU race condition during malware remediation (in Defender’s threat remediation engine) lets an authenticated, low-privilege user pause remediation via NTFS oplocks and redirect Defender operations th...

CVE-2026-1529

CVE-2026-1529 affects Keycloak. An attacker can craft/modify a legitimate invitation token’s JWT payload to change the organization ID and target email, exploiting a lack of cryptographic signature verification to self-register into an unauthorized organization and gain access. The vulnerability ...

CVE-2025-20352

CVE-2025-20352 concerns Cisco IOS/IOS XE SNMP subsystem. A stack-based buffer overflow could allow a low-privileged, authenticated remote attacker to cause a DoS (reload) or, with higher privileges, execute arbitrary code as root on affected devices. Exploitation requires SNMP credentials (v2c/v1...

CVE-2024-56325

Apache Pinot

CVE-2025-21877

CVE-2025-21877 (Linux kernel, usbnet gl620a) affects the usbnet implementation in the kernel where GenelInK_bind() fails to verify that the device actually provides the endpoints it requests. This can lead to a mismatch when an artificially manufactured endpoint is encountered, as Syzbot observed...

CVE-2025-22968

Affected product: D-Link DWR-M972V (firmware 1.05SSG). Vulnerability enables a remote attacker to execute arbitrary code via SSH as root without restrictions. Root-privileged code execution stems from the SSH implementation/firmware logic as described in multiple sources. No exploitation details ...

CVE-2023-3635

CVE-2023-3635 : Okio GzipSource does not handle an exception when parsing a malformed gzip buffer, enabling potential denial of service against Okio-based clients processing crafted GZIP archives. Connected IBM bulletins confirm the vulnerability and reference Okio 2.x usage in IBM products (e.g....

CVE-2022-42948

CVE-2022-42948 affects Cobalt Strike 4.7.1, due to improper escaping of HTML in Swing components, enabling remote code execution in the Cobalt Strike UI when crafted HTML is injected. The NVD indicates a critical CVSS v3.1 score (9.8) with network attack vector and no privileges/user interaction ...

CVE-2022-38750

CVE-2022-38750 concerns the SnakeYAML YAML parser. Multiple connected sources confirm the issue: parsing untrusted YAML can lead to a Denial of Service via stack overflow, impacting availability. The vulnerability is associated with the SnakeYAML package (Java) and is addressed in various advisor...

CVE-2022-30746

Summary: CVE-2022-30746 affects Samsung SmartThings prior to 1.7.85.12. A missing caller check in the JavaScript interface API can allow a remote attacker to access sensitive information. The vulnerability is described across multiple sources (NVD, Red Hat, CNVD/CNNVD references) as a missing cal...

CVE-2021-4154

CVE-2021-4154 is a Linux kernel use-after-free in cgroup v1 parsing (cgroup1_parse_param) that allows local privilege escalation via the fsconfig parameter, potentially enabling container breakout and system DoS. Affected component: kernel/cgroup/cgroup-v1.c in the Linux kernel. Root cause: use-a...

CVE-2020-28374

CVE-2020-28374 affects the Linux kernel’s SCSI target (LIO) code, specifically drivers/target/target_core_xcopy.c, where insufficient identifier checking could let a remote attacker read or write files via directory traversal in an XCOPY request. Affected component is the Linux kernel prior to 5....

CVE-2019-10906

CVE-2019-10906 affects Pallets Jinja2 before 2.10.1. The vulnerability arises from str.format_map allowing a sandbox escape, enabling potentially untrusted template code to escape sandbox restrictions. The issue is blocked to Jinja2’s sandboxed evaluation and affects environments using Pallets Ji...

CVE-2018-16042

CVE-2018-16042 is a security bypass affecting Adobe Acrobat and Reader versions listed (2019.008.20081/20080, 2017.011.30106/30105, 2015.006.30457/30456, and related builds). The vulnerability’s impact is information disclosure if exploited. The provided sources indicate a bypass issue without de...

CVE-2025-24201

CVE-2025-24201 is a WebKit/WebKitGTK issue described in connected advisories as an out-of-bounds write that allowed breaking out of the Web Content sandbox. Root cause: out-of-bounds write in WebKit. Impact: potential sandbox breakout affecting Apple WebKit-based products (Safari, iOS/iPadOS 18.x...

CVE-2025-0590

CVE-2025-0590 affects the TECNO/Transsion Carlcare mobile app. The root cause is improper permission settings that may cause information leakage (CVE-2025-0590; CVSS 3.1: 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation details are not provided in the documents; remediation/fixes are ...

CVE-2023-22079

CVE-2023-22079 concerns Oracle MySQL Server, component Server: Optimizer. Affected: MySQL 8.0.34 and earlier. Description: a low-privileged, network-accessible attacker can cause the MySQL Server to hang or crash (complete DoS) via multiple protocols. CVSS v3.1 base score 6.5 (Availability HIGH; ...

CVE-2023-39742

CVE-2023-39742 affects giflib v5.2.1, with a segmentation fault in getarg.c identified as the root cause. Several connected advisories confirm the issue across distributions (Amazon Linux, Fedora, Alpine, Mariner), noting patched/updated packages are available (e.g., giflib and related utilities/...

CVE-2023-23916

CVE-2023-23916 involves curl before 7.88.0 where an attacker could abuse the chained HTTP compression chain to create a degenerate decompression path. Although the cap on the number of links is per header, a malicious server can inject many headers to form an effectively unlimited decompression c...

CVE-2022-29253

The CVE-2022-29253 entries describe a path traversal in XWiki Platform. Affected versions are 8.3-rc-1 up to but not including 13.10.3 and 14.0 (i.e., versions prior to 12.10.3 and 14.0 are affected). The root cause is the template API allowing a path containing ".." to access files located in th...

CVE-2021-43798

Grafana CVE-2021-43798 is a directory traversal vulnerability affecting Grafana 8.0.0-beta1 through 8.3.0 (excluding patched versions). The flaw allows access to local files via the vulnerable URL path /public/plugins/ and related API paths described in the advisories. Upstream fixes were release...

CVE-2019-12614

CVE-2019-12614 affects Linux kernels up to 5.1.6 in the PowerPC pseries dlpar.c: a NULL pointer dereference triggered by unchecked kstrdup of prop->name can allow a local attacker to crash the system via a crafted request. The issue is confirmed in the initial description and corroborated by c...

CVE-2019-9947

CVE-2019-9947 is a CRLF injection vulnerability in urllib/urllib2. The issue affects Python 2.x up to 2.7.16 and Python 3.x up to 3.7.3, where an attacker controlling a URL parameter can insert CRLF sequences in the path (or query) component passed to urlopen/urlopen-like calls, potentially leadi...

CVE-2025-31650

CVE-2025-31650 affects Apache Tomcat and describes a DoS due to DoS via malformed HTTP/2 PRIORITY_UPDATE frames arising from improper input handling. Affects Tomcat 9.0.76–9.0.102, 10.1.10–10.1.39, and 11.0.0-M2–11.0.5 (including older EOL 8.5.x in discussions). Debian/AlmaLinux advisories refere...

CVE-2024-37890

The CVE-2024-37890 entry concerns the ws WebSocket library for Node.js. In vulnerable releases, a request containing more headers than server.maxHeadersCount can crash a ws server. The issue has been fixed in [email protected] and backported to [email protected], [email protected], and [email protected]. Remediation/mitigation av...

CVE-2024-23222

Summary (CVE-2024-23222) : A type confusion vulnerability in Apple WebKit leads to arbitrary code execution when processing malicious web content. The issue affects multiple Apple platforms and is fixed in versions listed by the sources: iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, and...

CVE-2023-22064

CVE-2023-22064 affects Oracle MySQL Server (Server: Optimizer) with affected versions 8.0.34 and earlier. The vulnerability allows a high-privilege attacker with network access via multiple protocols to cause a hang or repeatable crash (a complete DoS) of MySQL Server; CVSS v3.1 base score 4.9 (A...

CVE-2022-24999

CVE-2022-24999 affects the qs library prior to 6.10.3 used by Express before 4.17.3, enabling prototype poisoning via a[proto ] in query strings that can hang a Node process. An unauthenticated remote attacker can place the payload in the URL query. The advisory notes backported fixes to qs versi...

CVE-2022-28811

CVE-2022-28811 affects Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server 2.8.3. The vulnerability stems from improper input validation on an API-submitted parameter, enabling a remote, unauthenticated attacker to execute arbitrary OS commands. The CVSS score is 9.8 (Critical) with ...

CVE-2022-22005

CVE-2022-22005 – Microsoft SharePoint Server RCE is an authenticated-execution flaw in SharePoint Server. The initial document states that an authenticated user with Manage Lists permissions could cause arbitrary .NET code to run on the SharePoint Web Application service account. Exploitation wou...

CVE-2021-26937

CVE-2021-26937 affects the GNU Screen utility. The vulnerability exists in encoding.c when handling combining characters/UTF-8 sequences, and can enable a remote attacker to cause a denial of service (invalid write access and crash) or, in some advisories, potentially arbitrary code execution. Af...

CVE-2020-12695

CVE-2020-12695 (CallStranger) concerns UPnP SUBSCRIBE handling in the Open Connectivity Foundation specification prior to 2020-04-17. The root cause is a controllable Callback header that can trigger HTTP connections to arbitrary URLs, enabling SSRF-like behavior and potentially leading to amplif...

CVE-2025-5064

CVE-2025-5064 relates to an inappropriate implementation in Chrome's Background Fetch API that could leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (Chromium base). The issue is mitigated by upgrading to Chrome 137.0.7151.55 or later (Chromium fix referenced by Ch...

CVE-2023-22070

CVE-2023-22070 affects Oracle MySQL Server (Server: Optimizer). Affected: MySQL 8.0.34 and earlier and 8.1.0. Exploitation via network could cause high-availability impact (hang or crash). Remediation: upgrade to patched version (e.g., 8.0.35-1 or newer as referenced by Debian/Mariner advisories)...

CVE-2022-29909

CVE-2022-29909 is a Firefox/Thunderbird vulnerability described as privilege escalation via deeply-nested cross-origin browsing contexts that could inherit top-level permissions. Affected products and versions from connected advisories: Thunderbird < 91.9 and Firefox (including ESR)

CVE-2022-29060

Fortinet's FortiDDoS API is affected by a hard-coded cryptographic key vulnerability (CWE-321) across FortiDDoS API versions 5.1.0–5.5.1. An attacker who can retrieve the key from one device can sign JWT tokens for any device, enabling unauthorized access. The issue is documented in Fortinet PSIR...

CVE-2018-21028

CVE-2018-21028 affects Boa up to 0.94.14rc21; memory leak caused by missing calls to free. Descriptions from NVD/UBU/etc. indicate remote attackers could trigger the leak, but there is no explicit exploit/wild status provided in the connected documents. Remediation/fixes are not detailed in the s...

CVE-2017-14492

CVE-2017-14492 is a heap-based buffer overflow in dnsmasq’s IPv6 router advertisement (RA) handling. Affected configurations include enabling RA-related options (enable-ra, ra-only, slaac, ra-names, ra-advrouter, ra-stateless). Impact per the sources: remote code execution or crash on the local n...

CVE-2013-1048

The CVE-2013-1048 entry concerns the Debian Apache HTTP Server: the apache2ctl script fails to properly create the /var/lock/apache2 directory in affected builds (squeeze < 2.2.16-6+squeeze11, wheezy < 2.2.22-13, sid

CVE-2026-48907

CVE-2026-48907 — Joomla JCE extension unauthenticated RCE is a vulnerability in the Joomla Content Editor (JCE) that allows unauthenticated users to create editor profiles and upload PHP payloads, enabling remote code execution. Technical details across documents show an unrestricted file upload ...

CVE-2022-41725

CVE-2022-41725 affects Go’s net/http and mime/multipart form parsing. The vulnerability originated from ReadForm/ParseMultipartForm not fully accounting memory (map entries, names, headers) and not limiting disk-file creation, allowing large forms to exceed 10MB+maxMemory in memory and to generat...

CVE-2022-31004

CVE-2022-31004 affects the open source CVE services API project cve-services. A conditional in data.js can cause the generated randomKey to be written to disk when not running in development, potentially exposing plaintext secrets on disk in production. Public details do not list a released patch...

CVE-2022-27228

CVE-2022-27228 affects Bitrix Site Manager’s built-in vote (Polls, Votes) module prior to version 21.0.100. A remote unauthenticated attacker can execute arbitrary code on affected systems due to the module’s vulnerability, with CVSS overall high impact (C/H/I/A all high) reported in multiple sou...

CVE-2019-19270

ProFTPD TLS CRL check flaw: tls_verify_crl in ProFTPD up to 1.3.6b does not properly verify CRL entry fields, potentially allowing revoked certificates to connect. OpenSUSE/Fedora advisories fix CVE-2019-19270 by updating ProFTPD to 1.3.6b (and later) and related patches in 1.3.6/1.3.6a/b. Applie...