CVE-2019-10211

CVE-2019-10211 affects PostgreSQL Windows installers prior to 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24. Root cause: bundled OpenSSL (libeay32.dll) loads configuration from a hardcoded directory during SSL initialization, enabling a local attacker to execute arbitrary code with the calling process’s pr...

CVE-2016-4157

CVE-2016-4157 affects Adobe Creative Cloud Desktop Application for Windows prior to 3.7.0.272. The issue is an untrusted search path vulnerability in the installer , enabling local users to gain privileges via a Trojan horse resource in an unspecified directory. This CVE is part of a set describe...

CVE-2024-52301

CVE-2024-52301 affects the Laravel framework. When the PHP directive register_argc_argv is on, a crafted query string can alter the request-handling environment on non-cli SAPIs. This article notes the fix: Laravel now ignores argv values for environment detection on non-cli SAPIs, and the vulner...

CVE-2024-9143

CVE-2024-9143 describes a vulnerability in OpenSSL: using low-level GF(2^m) ECC APIs with untrusted explicit field-polynomial values can cause out-of-bounds memory reads/writes, potentially crashing an application or enabling remote code execution. Affected are APIs like EC_GROUP_new_curve_GF2m()...

CVE-2024-24989

CVE-2024-24989 affects NGINX Plus and NGINX Open Source when configured with the HTTP/3 QUIC module. The underlying issue is in the HTTP/3 QUIC module, which can cause NGINX worker processes to terminate, yielding a denial-of-service condition. The vulnerability is tied to the HTTP/3 QUIC module ...

CVE-2023-4504

CVE-2023-4504 affects the OpenPrinting CUPS stack and its libppd component, caused by a failure to validate the length of an attacker-crafted PPD PostScript document. This leads to a heap-based buffer overflow, with potential for code execution as described in the fixed release notes. The vulnera...

CVE-2023-28229

CVE-2023-28229 is a Windows vulnerability in the Cryptographic Next Generation (CNG) Key Isolation Service described as a privilege-escalation flaw. The CVE entry is linked to active exploitation in practice (CISA KEV) and is categorized with a high impact vector (local access, total impact on co...

CVE-2023-28433

MinIO on Windows is affected by a privilege-escalation issue where the product fails to filter the backslash () character, enabling an attacker with low privileges (e.g., a limited PutObject key) to place objects across buckets and create an admin user. The concrete root cause is path separator h...

CVE-2022-1996

The CVE-2022-1996 issue affects the Go RESTful package golang-github-emicklei-go-restful in affected repos prior to version 3.8.0. The vulnerability is described as an Authorization Bypass Through User-Controlled Key, enabling bypass of access controls when handling requests in the go-restful fra...

CVE-2022-30617

The CVE-2022-30617 issue affects Strapi where an authenticated admin-panel user can read private data (e.g., emails, password reset tokens) for other admin users via related content in the JSON response. This leakage occurs across relationships (e.g., content created/updated by another user) and ...

CVE-2020-1025

CVE-2020-1025 affects Microsoft SharePoint Server and Skype for Business Server. The vulnerability is an elevation of privilege caused by improper OAuth token validation, enabling an attacker to bypass authentication by modifying the token. The published fixes modify how tokens are validated to a...

CVE-1999-0236

The CVE-1999-0236 entry describes a vulnerability in the ScriptAlias directory handling in NCSA and Apache httpd that allowed attackers to read CGI programs. Affected software is the Apache httpd family utilizing ScriptAlias configuration; the underlying issue is directory handling enabling discl...

CVE-2026-21722

Grafana CVE-2026-21722 affects the public dashboards annotations feature. The vulnerability allows a user to read the entire annotation history visible on a dashboard when timerange locking is disabled, exposing history outside the locked timerange. Root cause is that annotation timeranges were n...

CVE-2025-14087

CVE-2025-14087 describes a buffer-underflow in GLib’s GVariant parser that can cause heap corruption, potentially leading to denial of service or remote code execution when processing crafted input strings. The connected advisories pin the vulnerability to GLib (glib2) across multiple packages an...

CVE-2024-57075

CVE-2024-57075 affects eazy-logger v4.0.1: prototype pollution in the lib.Logger function can load a crafted payload to modify Object.prototype, enabling denial of service (DoS). Public docs include a PoC that injects into the global prototype chain (e.g., via proto ), with outcomes ranging from ...

CVE-2025-0283

Technical details for CVE-2025-0283 are not publicly available in the provided documents. Connected items cover CVE-2025-0282 and related advisories, but do not specify affected products, impacts, or fixes for CVE-2025-0283. Monitor for updates.

CVE-2023-1192

CVE-2023-1192 denotes a use-after-free in CIFS smb2_is_status_io_timeout() within the Linux kernel, where memory freed during a system call and CIFS’ later access to that memory can trigger a denial of service. The connected advisories confirm this UAF issue exists in kernel CIFS code and link it...

CVE-2023-21967

CVE-2023-21967 affects Oracle Java SE and GraalVM Enterprise Edition (JSSE, Swing, Hotspot, Libraries) with multiple vulnerable versions including Java 8u361, 11.0.18, 17.0.6, 20 and GraalVM 20.3.9/21.3.5/22.3.1. Root cause is unresolved issues in the Java components allowing unauthenticated netw...

CVE-2022-29214

CVE-2022-29214 affects NextAuth.js (next-auth). The vulnerability is an open redirect when implementing an OAuth 1 provider, present in versions prior to 3.29.3 (v3) and 4.3.3 (v4). A patch exists in those respective versions (3.29.3 and 4.3.3). If upgrading is not possible, a workaround is docum...

CVE-2022-29474

Summary of CVE-2022-29474 (F5 BIG-IP iControl SOAP directory traversal) Vulnerability: A directory traversal in iControl SOAP allows an authenticated user with at least guest privileges to read wsdl files from the BIG-IP filesystem. Affected products/versions (as cited by multiple sources): BIG-I...

CVE-2020-10704

CVE-2020-10704 affects Samba acting as an Active Directory Domain Controller. The vulnerability is a stack overflow in the AD DC LDAP server triggered by certain requests, enabling an unauthorized user to cause a denial of service, impacting availability. Public disclosures in connected Debian Fe...

CVE-2018-5745

CVE-2018-5745 affects BIND's managed-keys feature, causing an assertion failure (and possible server exit) when a trust anchor is rolled over to an unsupported key algorithm. Affected: BIND 9 series (various 9.9.x–9.13.x branches and preview releases). Impact: potential denial of service by crash...

CVE-2013-2070

The CVE concerns nginx proxying behavior and chunked transfer handling. Affected product: nginx with the proxy module/http parsing paths noted in CVE-2013-2070 (versions 1.1.4–1.2.8 and 1.3.0–1.4.0) when proxy_pass is used to untrusted upstream HTTP servers. Root cause: crafted proxy responses ca...

CVE-2026-22732

CVE-2026-22732 affects Spring Security; multiple non-legacy branches are impacted where HTTP response headers for servlet applications may not be written. Affected versions include 5.7.0–5.7.21, 5.8.0–5.8.23, 6.3.0–6.3.14, 6.4.0–6.4.14, 6.5.0–6.5.8, and 7.0.0–7.0.3. The description indicates a he...

CVE-2025-59230

CVE-2025-59230 describes an improper access control flaw in the Windows Remote Access Connection Manager (RasMan). The vulnerability allows an authenticated local user to elevate privileges to SYSTEM by manipulating RasMan’s IPC handling/ACLs, as reported in multiple sources. Exploitation activit...

CVE-2025-59798

Artifex Ghostscript

CVE-2018-9405

CVE-2018-9405 describes a potential out-of-bounds write in BnDmAgent::onTransact (dm_agent.cpp) due to a missing bounds check, enabling local privilege escalation to System level without user interaction. Affected context shown in multiple sources (Android Pixel/Nexus bulletin references and vend...

CVE-2024-0012

CVE-2024-0012 is an authentication bypass in Palo Alto Networks PAN-OS management web interface that lets an unauthenticated, network-reachable attacker gain PAN-OS administrator privileges. Affected products/versions: PAN-OS 10.2, 11.0, 11.1, and 11.2; Cloud NGFW and Prisma Access are not impact...

CVE-2024-21011

CVE-2024-21011 affects Oracle Java SE platforms (Hotspot) and Oracle GraalVM for JDK/Enterprise Edition. Affected versions include Java SE: 8u401, 11.0.22, 17.0.10, 21.0.2, 22; GraalVM for JDK: 17.0.10, 21.0.2, 22; GraalVM EE: 20.3.13, 21.3.9. The vulnerability is exploitable over a network by un...

CVE-2021-46954

CVE-2021-46954 affects the Linux kernel net/sched IPv4 path. When act_mirred attempts to fragment IPv4 packets that were previously reassembled by act_ct, sch_frag used a temporary dst_entry, which was later treated as an rtable pointer in the fragment/MTU flow. This caused a stack out-of-bounds ...

CVE-2022-48564

CVE-2022-48564 affects Python up to 3.9.1: read_ints in plistlib.py is vulnerable to a DoS via CPU/RAM exhaustion when processing malformed binary Apple Property List files. The impact is denial of service; exploitation details are not provided in the documents. Remediation is to apply the approp...

CVE-2023-21937

CVE-2023-21937 is an in-scope vulnerability affecting Oracle Java SE / GraalVM Enterprise Edition (Networking, Swing, Libraries, Hotspot, JSSE, etc.) with 8u361, 11.0.18, 17.0.6, 20 and related GraalVM versions impacted. It involves NULL-character handling and related input validation issues that...

CVE-2022-20929

CVE-2022-20929 concerns Cisco Enterprise NFV Infrastructure Software (NFVIS) where upgrade signature verification is insufficient. The issue allows an unauthenticated, local attacker to supply an unauthentic upgrade file for upload, potentially leading to full system compromise. Affected componen...

CVE-2022-29353

Affected software: Graphql-upload v13.0.0 (Node.js middleware). Vulnerable component: file upload module; root cause: arbitrary file upload via crafted filename enables code execution. Impact: remote code execution with high/critical severity indicators (network vector, no authentication; confide...

CVE-2021-32399

CVE-2021-32399 affects the Linux kernel’s Bluetooth HCI handling, specifically a race condition in removal of the HCI controller implemented in net/bluetooth/hci_request.c up to version 5.12.2. The connected Astra Linux entry references the same race condition in the Linux kernel, and a dated Lin...

CVE-2018-3174

CVE-2018-3174 affects Oracle MySQL Server (notably the Client programs) with affected versions 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior, and 8.0.12 and prior. Root cause per the sources is a vulnerability in MySQL Server that can, under certain conditions, lead to a hang or a complete...

CVE-2018-1067

The CVE-2018-1067 entry affects Undertow prior to 7.1.2.CR1 and 7.1.2.GA, where the prior fix for CVE-2016-4993 was incomplete. This leaves Undertow vulnerable to injection of arbitrary HTTP headers and HTTP response splitting due to insufficient sanitization and validation when user input is use...

CVE-2017-17215

CVE-2017-17215 is a Huawei HG532/HG532u series router remote code execution vulnerability. An authenticated attacker can send crafted packets to port 37215 to trigger upnp-related logic and execute arbitrary code. Public discussions and malware analyses (including HG532/ HG532e modifications and ...

CVE-2024-31449

CVE-2024-31449 affects Redis with Lua scripting. An authenticated user can trigger a stack overflow in the Lua bit library via a crafted script, potentially enabling remote code execution. The issue affects all Redis versions that support Lua scripting and is fixed in Redis 6.2.16, 7.2.6, and 7.4...

CVE-2023-39323

CVE-2023-39323 affects golang (Go) where the //line directive can bypass //go:cgo_ restrictions, potentially enabling arbitrary code execution during go build. Connected advisories indicate affected golang packages across distributions with versions below patched releases (e.g., Mariner: < 1.2...

CVE-2023-29404

The CVE-2023-29404 description is corroborated by connected advisories: it concerns the go command executing code at build time when using cgo, triggered by LDFLAGS in a #cgo LDFLAGS directive, affecting gc and gccgo. The root cause is improper handling of certain linker flags, allowing disallowe...

CVE-2023-32324

OpenPrinting CUPS (up to version 2.4.2 and earlier) contains a heap buffer overflow in format_log_line that can cause a DoS when cupsd.conf loglevel is set to DEBUG. The issue is exploitable remotely according to the CVE description, with impact limited to availability (DoS) and no confidentialit...

CVE-2023-27765

CVE-2023-27765 affects Wondershare Recoverit v10.6.3. The vulnerability allows an attacker to execute arbitrary commands through the recoverit_setup_full4134.exe file. Affected software is Wondershare Recoverit 10.6.3; the underlying cause is with the setup executable, per multiple sources (NVD/R...

CVE-2021-33164

CVE-2021-33164 is an Intel NUC BIOS/firmware vulnerability described as improper access control in BIOS firmware for certain Intel NUCs prior to INWHL357.0046, potentially allowing a locally privileged user to escalate privileges. The Red Hat advisory and Intel security advisory confirm the affec...

CVE-2022-33980

CVE-2022-33980 affects Apache Commons Configuration (versions 2.4–2.7). The vulnerability arises in the default interpolation lookups, where interpolation of the form ${prefix:name} can trigger lookups such as script , dns , and url . These lookups could enable arbitrary code execution or contact...

CVE-2020-7039

CVE-2020-7039 affects SLiRP’s tcp_emu in libslirp (used by QEMU 4.2.0); memory mismanagement can cause a heap-based buffer overflow leading to DoS or potential arbitrary code execution. Public advisories confirm fixes are shipped in updated qemu-kvm/qemu releases (e.g., Debian: 1:1.0.17-8+deb9u1;...

CVE-2017-5982

CVE-2017-5982 : Kodi Chorus2 add-on for Kodi (Chorus2 2.4.2) is affected by a directory traversal vulnerability. An unauthenticated remote attacker can read arbitrary files by supplying a crafted image path containing encoded traversal sequences (for example, image/image%3A//..%252fetc%252fpasswd...

CVE-2026-41722

CVE-2026-41722 is a stored cross-site scripting vulnerability affecting VMware Cloud Foundation Operations and related products. The NVD/Broadcom advisory describes that a malicious actor with privileges to create policies, views, or text-widgets can inject scripts to perform administrative actio...

CVE-2024-37891

CVE-2024-37891 affects urllib3 (Python HTTP client) across multiple distributions (e.g., python3-urllib3, python3.13-pip, python-pip, etc.). The issue: when not using urllib3’s ProxyManager proxy support, a configured Proxy-Authorization header could be sent, and urllib3 may not strip it on cross...

CVE-2024-1249

CVE-2024-1249 affects Keycloak’s OIDC component, specifically the checkLoginIframe path, where unvalidated cross-origin messages are accepted. The root cause is a lack of origin validation for incoming cross-origin communications, enabling an adversary to coordinate many requests and potentially ...