Lucene search
+L
CvelistMost viewed

381495 matches found

Cvelist
Cvelist
added 2026/04/15 5:20 p.m.75 views

CVE-2026-5758 Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution...

0.00534EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/04/01 12:22 p.m.75 views

CVE-2026-29014 MetInfo CMS Unauthenticated PHP Code Injection RCE

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve...

9.8CVSS0.41576EPSS
SaveExploits4References3
Cvelist
Cvelist
added 2026/03/12 6:27 p.m.75 views

CVE-2026-3497

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpktdisconnect on an error, which does not terminate the...

6.9CVSS0.0218EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/03/06 12:00 a.m.75 views

CVE-2025-69651

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dumprelocations returns early due to parsing errors, the internal allrelocations array may remain partially uninitialized...

0.0024EPSS
SaveExploits1References5
Cvelist
Cvelist
added 2026/02/24 1:33 p.m.75 views

CVE-2026-2784 Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

0.0043EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/01/28 3:15 p.m.75 views

CVE-2026-1536 Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF Carriage Return Line Feed sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP...

5.8CVSS0.00298EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2026/01/16 4:44 p.m.75 views

CVE-2026-23528 Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting XSS bug in the Dask...

5.3CVSS0.00213EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2025/10/22 2:32 p.m.75 views

CVE-2025-52738 WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through = 1.15.0...

6.5CVSS0.0029EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2025/07/21 7:57 p.m.75 views

CVE-2025-7272 IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability

IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the...

7.8CVSS0.0022EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2025/07/07 5:57 p.m.75 views

CVE-2025-53536 Roo Code allows Potential Remote Code Execution via .vscode/settings.json

Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with...

8.1CVSS0.00656EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2025/04/23 11:36 a.m.75 views

CVE-2025-2703

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...

6.8CVSS0.18205EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2025/03/27 2:41 p.m.75 views

CVE-2025-1998 IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy information disclosure

IBM UrbanCode Deploy UCD through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 stores potentially sensitive authentication token information in log files that could be read by a local user...

5.5CVSS0.00167EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2024/12/25 4:22 a.m.75 views

CVE-2024-12428 WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection

The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'orderuserlogindir' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

7.5CVSS0.00479EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2024/12/12 9:04 a.m.75 views

CVE-2024-4109

...

SaveExploits0
Cvelist
Cvelist
added 2024/11/25 7:37 a.m.75 views

CVE-2024-10492 Keycloak-quarkus-server: keycloak path trasversal

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

2.7CVSS0.00727EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2024/11/24 12:44 a.m.75 views

CVE-2024-11236 Integer overflow in the firebird and dblib quoters causing OOB writes

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, uncontrolled long string inputs to ldapescape function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write...

9.8CVSS0.02079EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2024/11/13 2:02 a.m.75 views

CVE-2024-10038 WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

6.1CVSS0.00354EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2024/11/04 10:56 p.m.75 views

CVE-2024-51501 CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes Header, HeaderCollection and Authorize are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method. This...

10CVSS0.00558EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2024/10/31 4:15 p.m.75 views

CVE-2024-51478 Use of a Broken or Risky Cryptographic Algorithm in YesWiki

YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5...

9.9CVSS0.00373EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2024/10/02 4:56 p.m.75 views

CVE-2024-20517 Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities

A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service DoS condition. To exploit...

6.8CVSS0.00443EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2024/09/10 4:53 p.m.75 views

CVE-2024-37339 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

...

8.8CVSS0.01623EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2024/09/09 6:49 p.m.75 views

CVE-2024-7260 Keycloak-core: open redirect on account page

An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referreruri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it...

6.1CVSS0.00579EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2024/09/08 11:58 a.m.75 views

CVE-2024-42342 Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Loway - CWE-444: Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling'...

4.3CVSS0.0028EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2024/07/16 10:39 p.m.75 views

CVE-2024-21140

...

4.8CVSS0.0094EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2024/07/10 6:25 p.m.75 views

CVE-2024-27090 Decidim vulnerable to data disclosure through the embed feature

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded such as a...

5.3CVSS0.00492EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2024/06/24 9:59 a.m.75 views

CVE-2024-29868 Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

Use of Cryptographically Weak Pseudo-Random Number Generator PRNG vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue...

0.05995EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2024/06/19 7:48 p.m.75 views

CVE-2024-38355 Unhandled 'error' event in socket.io

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in...

7.3CVSS0.0069EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2024/05/23 1:56 a.m.75 views

CVE-2024-4978 Malicious Code in Justice AV Solutions (JAVS) Viewer

Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands...

8.7CVSS8.4AI score0.26937EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2024/05/16 2:09 p.m.75 views

CVE-2024-34905

FlyFish v3.0.0 was discovered to contain a buffer overflow via the password parameter on the login page. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

7.8AI score0.00552EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2024/04/12 12:36 p.m.75 views

CVE-2024-31289 WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Elementor Hello Elementor.This issue affects Hello Elementor: from n/a through 3.0.0...

4.3CVSS5AI score0.002EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2024/03/22 11:09 p.m.75 views

CVE-2024-29059 .NET Framework Information Disclosure Vulnerability

...

7.5CVSS7.8AI score0.98624EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2024/03/06 8:25 p.m.75 views

CVE-2024-27918 Coder's OIDC authentication allows email with partially matching domain to register

Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the...

8.2CVSS8.5AI score0.00965EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2024/02/05 9:21 p.m.75 views

CVE-2024-0324 User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppbtwofactorauthenticationsettingsupdate' function in all versions up to, and including...

8.2CVSS8.2AI score0.02432EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2024/01/29 10:41 p.m.75 views

CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

6.5CVSS7.3AI score0.01029EPSS
SaveExploits1References5
Cvelist
Cvelist
added 2023/12/25 11:31 p.m.75 views

CVE-2023-7107 code-projects E-Commerce Website user_signup.php sql injection

A vulnerability was found in code-projects E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file usersignup.php. The manipulation of the argument firstname/middlename/email/address/contact/username leads to sql injection. The attac...

7.5CVSS7.7AI score0.00924EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2023/08/08 10:29 a.m.75 views

CVE-2023-4203 Stored Cross-Site Scripting

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface...

9CVSS8.1AI score0.01079EPSS
SaveExploits2References3
Cvelist
Cvelist
added 2023/05/12 1:18 p.m.75 views

CVE-2023-1934

The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and...

9.8CVSS9.9AI score0.08079EPSS
SaveExploits3References2
Cvelist
Cvelist
added 2023/05/11 8:51 p.m.75 views

CVE-2023-31146 Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment...

7.5CVSS9.5AI score0.01241EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2023/04/11 7:13 p.m.75 views

CVE-2023-28260 .NET DLL Hijacking Remote Code Execution Vulnerability

...

7.8CVSS7.7AI score0.01531EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2022/11/21 12:00 a.m.75 views

CVE-2022-3388 Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 Products

An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role...

8.8CVSS9.1AI score0.00277EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2022/02/18 7:51 p.m.75 views

CVE-2022-24048

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

7CVSS8.3AI score0.00689EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2021/11/15 12:00 a.m.75 views

CVE-2021-42375

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input...

7.4AI score0.00378EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2021/08/25 6:16 p.m.75 views

CVE-2021-21869

An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this...

8.8CVSS8AI score0.01755EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2021/05/14 7:35 p.m.75 views

CVE-2021-29521 Segfault in SparseCountSparseOutput

TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in tf.rawops.SparseCountSparseOutput results in a segmentation fault being thrown out from the standard library as std::vector invariants are broken. This is because the...

2.5CVSS5.7AI score0.00189EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2021/04/30 11:44 a.m.75 views

CVE-2020-24918

A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP request, with a long digest authentication header, to execute arbitrary code in parseauthenticationheader in libamprotocol-rtsp.so.1 in rtspsvc or cause a...

10AI score0.04358EPSS
SaveExploits1References4
Cvelist
Cvelist
added 2021/03/15 5:03 p.m.75 views

CVE-2021-25667

A vulnerability has been identified in RUGGEDCOM RM1224 All versions = V4.3 and = V4.3 and = V4.3 and = V2.0 and V2.1.3, SCALANCE XB-200 All versions V4.1, SCALANCE XC-200 All versions V4.1, SCALANCE XF-200BA All versions V4.1, SCALANCE XM400 All versions V6.2, SCALANCE XP-200 All versions V4.1,...

9.1AI score0.00859EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2021/02/14 3:43 a.m.75 views

CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 where the HordeTextFilter library before 2.3.7 is used. The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke us...

6.1AI score0.04944EPSS
SaveExploits7References7
Cvelist
Cvelist
added 2021/01/12 7:42 p.m.75 views

CVE-2021-1648 Microsoft splwow64 Elevation of Privilege Vulnerability

...

7.8CVSS8.3AI score0.01229EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2020/12/31 8:20 a.m.75 views

CVE-2020-35911

An issue was discovered in the lockapi crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness...

4.7AI score0.00207EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2020/09/11 12:00 a.m.75 views

CVE-2020-1045 Microsoft ASP.NET Core Security Feature Bypass Vulnerability

...

7.5CVSS7.5AI score0.05974EPSS
SaveExploits0References6
Total number of security vulnerabilities5000