Lucene search
+L
NvdMost viewed

379084 matches found

NVD
NVD
added 2008/10/07 8:0 p.m.71 views

CVE-2008-4421

Directory traversal vulnerability in MetaGauge 1.0.0.17, and probably other versions before 1.0.3.38, allows remote attackers to read arbitrary files via a ".." dot dot backslash in the URL...

7.8CVSS6.5AI score0.03788EPSS
SaveExploits7References7
NVD
NVD
added 2026/07/10 9:16 p.m.70 views

CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauthclientsecret, exposing credentials to unauthenticated callers when the...

8.7CVSS0.00784EPSS
SaveExploits0References6
NVD
NVD
added 2026/06/12 10:16 p.m.70 views

CVE-2026-46716

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers= and an arbitrary Command. At every tick of the scheduler, the dashboard...

9.9CVSS0.0043EPSS
SaveExploits1References1
NVD
NVD
added 2026/05/29 7:16 p.m.70 views

CVE-2026-49375

In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page...

6.1CVSS0.00223EPSS
SaveExploits0References1
NVD
NVD
added 2026/05/12 3:16 a.m.70 views

CVE-2026-40135

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of...

6.5CVSS0.01398EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/09 11:16 p.m.70 views

CVE-2026-8212

A flaw has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this vulnerability is the function SWSDfldsrch of the file frmts/hdf4/hdf-eos/SWapi.c. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been published and may be...

5.5CVSS0.00205EPSS
SaveExploits1References8
NVD
NVD
added 2026/05/09 9:16 p.m.70 views

CVE-2026-8196

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation causes authorization bypass. The attack...

6.3CVSS0.00463EPSS
SaveExploits0References4
NVD
NVD
added 2025/12/19 9:15 p.m.70 views

CVE-2023-53950

InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file extension restrictions through filename manipulation. Attackers can upload malicious ASP shells by using null byte techniques and alternate file extensions to circumvent upload...

9.8CVSS0.00637EPSS
SaveExploits0References3
NVD
NVD
added 2025/11/15 7:15 a.m.70 views

CVE-2025-13190

A vulnerability was found in D-Link DIR-816L 206b09beta. This vulnerability affects the function scandirmain of the file /portal/ajaxexporer.sgi. The manipulation of the argument en results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public a...

9CVSS0.0082EPSS
SaveExploits1References5
NVD
NVD
added 2025/10/16 6:15 p.m.70 views

CVE-2025-62412

LibreNMS is a community-based GPL-licensed network monitoring system. The alert rule name in the Alerts Alert Rules page is not properly sanitized, and can be used to inject HTML code. This vulnerability is fixed in 25.10.0...

4.8CVSS0.00258EPSS
SaveExploits1References2
NVD
NVD
added 2025/09/05 10:15 p.m.70 views

CVE-2025-58369

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS...

5.3CVSS0.00427EPSS
SaveExploits0References7
NVD
NVD
added 2025/08/12 6:15 p.m.70 views

CVE-2025-49736

The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network...

4.3CVSS0.00493EPSS
SaveExploits0References1
NVD
NVD
added 2025/04/14 3:15 p.m.70 views

CVE-2025-2475

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...

5.4CVSS0.00219EPSS
SaveExploits0References1
NVD
NVD
added 2025/04/01 7:15 p.m.70 views

CVE-2025-31137

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

7.5CVSS0.01151EPSS
SaveExploits0References1
NVD
NVD
added 2025/01/06 3:15 p.m.70 views

CVE-2024-8474

OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic...

7.5CVSS0.00546EPSS
SaveExploits0References1
NVD
NVD
added 2024/11/13 2:15 a.m.70 views

CVE-2024-10038

The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

6.1CVSS0.00345EPSS
SaveExploits0References2
NVD
NVD
added 2024/11/12 6:15 p.m.70 views

CVE-2024-49039

Windows Task Scheduler Elevation of Privilege Vulnerability...

8.8CVSS0.13719EPSS
SaveExploits2References2
NVD
NVD
added 2024/11/12 5:15 p.m.70 views

CVE-2024-51749

Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in...

3.5CVSS0.0033EPSS
SaveExploits0References2
NVD
NVD
added 2024/10/22 9:15 p.m.70 views

CVE-2024-45526

An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually...

5.3CVSS0.00504EPSS
SaveExploits0References1
NVD
NVD
added 2024/08/13 6:15 p.m.70 views

CVE-2024-38193

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability...

7.8CVSS0.27358EPSS
SaveExploits4References3
NVD
NVD
added 2024/08/12 4:15 p.m.70 views

CVE-2024-42485

Filament Excel enables excel export for Filament admin resources. The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patched with Version v2.3.3...

7.5CVSS0.0057EPSS
SaveExploits0References2
NVD
NVD
added 2024/08/12 1:38 p.m.70 views

CVE-2024-22116

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure...

9.9CVSS0.01603EPSS
SaveExploits0References2
NVD
NVD
added 2024/07/15 8:15 p.m.70 views

CVE-2024-40624

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...

9.8CVSS0.00995EPSS
SaveExploits0References3
NVD
NVD
added 2024/06/21 1:15 p.m.70 views

CVE-2024-35771

Cross-Site Request Forgery CSRF vulnerability in presscustomizr Customizr.This issue affects Customizr: from n/a through 4.4.21...

8.8CVSS0.0022EPSS
SaveExploits0References1
NVD
NVD
added 2024/05/14 5:15 p.m.70 views

CVE-2023-24204

SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parameter in get-quote.php...

5.4CVSS8.2AI score0.00639EPSS
SaveExploits2References3
NVD
NVD
added 2024/04/30 11:15 p.m.70 views

CVE-2024-4192

Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process...

7.8CVSS7.7AI score0.00322EPSS
SaveExploits0References1
NVD
NVD
added 2024/03/27 3:15 a.m.70 views

CVE-2024-25391

A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2...

8.4CVSS7.1AI score0.00323EPSS
SaveExploits0References6
NVD
NVD
added 2024/03/21 10:15 p.m.70 views

CVE-2024-28117

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute...

8.8CVSS9.2AI score0.01382EPSS
SaveExploits1References2
NVD
NVD
added 2024/03/16 5:15 a.m.70 views

CVE-2024-22259

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...

8.1CVSS7.8AI score0.02573EPSS
SaveExploits1References2
NVD
NVD
added 2024/01/31 2:15 p.m.70 views

CVE-2023-6246

A heap-based buffer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name the basename of...

8.4CVSS8.4AI score0.04794EPSS
SaveExploits7References13
NVD
NVD
added 2024/01/18 7:15 p.m.70 views

CVE-2024-22419

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the buildIR for concat doesn't properly adhere to the API of co...

9.8CVSS8.1AI score0.0077EPSS
SaveExploits1References3
NVD
NVD
added 2023/10/03 12:15 p.m.70 views

CVE-2023-25989

Cross-Site Request Forgery CSRF vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading...

8.8CVSS5.9AI score0.00434EPSS
SaveExploits0References10
NVD
NVD
added 2022/12/18 10:15 p.m.70 views

CVE-2021-4257

A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the component Task Handler. The manipulation of the argument site.org.name/check.name/task.tasktype.name/task.name leads to cross site scripting. The...

6.1CVSS0.00385EPSS
SaveExploits0References2
NVD
NVD
added 2022/06/09 8:15 p.m.70 views

CVE-2022-31033

The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site...

7.5CVSS0.01422EPSS
SaveExploits0References4
NVD
NVD
added 2026/06/02 4:16 p.m.69 views

CVE-2026-44367

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, a vulnerability exists in the user registration and login mechanisms due to inconsistent handling of username case sensitivity, leading to a targeted Denial of Service DoS and complete account...

2.7CVSS0.00236EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/15 10:16 p.m.69 views

CVE-2026-45347

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.11, there is a blind server side request forgery SSRF via the PDF generate function. In the PDF export, user inputs are interpreted as HTML and embedded into the PDF. According to tests...

5.4CVSS0.00186EPSS
SaveExploits1References1
NVD
NVD
added 2026/05/12 3:16 a.m.69 views

CVE-2026-34260

SAP S/4HANA SAP Enterprise Search for ABAP contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the...

9.6CVSS0.00466EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/11 7:16 p.m.69 views

CVE-2026-43969

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cowcookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs...

3.2CVSS0.00145EPSS
SaveExploits0References3
NVD
NVD
added 2026/05/07 10:16 p.m.69 views

CVE-2026-33111

Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to disclose information over a network...

7.5CVSS0.01135EPSS
SaveExploits0References1
NVD
NVD
added 2026/05/07 4:16 a.m.69 views

CVE-2026-41673

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DO...

8.7CVSS0.00643EPSS
SaveExploits0References16
NVD
NVD
added 2025/10/16 10:15 a.m.69 views

CVE-2025-6338

There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period. This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2...

9.2CVSS0.00395EPSS
SaveExploits0References1
NVD
NVD
added 2025/04/20 3:15 a.m.69 views

CVE-2025-43929

openactions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document e.g., a document opened in KDE ghostwriter...

7.8CVSS0.00184EPSS
SaveExploits1References5
NVD
NVD
added 2025/02/04 11:15 a.m.69 views

CVE-2024-27137

In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these...

5.3CVSS0.00276EPSS
SaveExploits0References2
NVD
NVD
added 2024/12/19 6:15 p.m.69 views

CVE-2024-12792

A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file newadmin.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed...

9.8CVSS0.00636EPSS
SaveExploits1References4
NVD
NVD
added 2024/11/18 2:15 a.m.69 views

CVE-2024-11306

A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processing of the file /index.php/display/database/. The manipulation leads to improper authorization. The attack may be initiated remotely. The...

6.9CVSS0.00534EPSS
SaveExploits0References4
NVD
NVD
added 2024/11/14 3:15 p.m.69 views

CVE-2022-2232

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

7.5CVSS0.00642EPSS
SaveExploits0References5
NVD
NVD
added 2024/10/15 8:15 p.m.69 views

CVE-2024-44337

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the...

5.1CVSS0.00506EPSS
SaveExploits1References2
NVD
NVD
added 2024/09/30 9:15 a.m.69 views

CVE-2024-45772

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected. Users ar...

8CVSS0.00582EPSS
SaveExploits0References2
NVD
NVD
added 2024/09/10 3:15 p.m.69 views

CVE-2024-27257

IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users...

4.3CVSS0.00304EPSS
SaveExploits0References2
NVD
NVD
added 2024/07/29 9:15 p.m.69 views

CVE-2023-42925

The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access Notes attachments...

3.3CVSS0.00163EPSS
SaveExploits0References2
Total number of security vulnerabilities5000