Lucene search
+L
NvdMost viewed

380435 matches found

NVD
NVD
•added 2022/03/09 11:15 p.m.•60 views

CVE-2022-24753

Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are stripe login, stripe config -e, stripe community, and stripe open. MacOS and Linu...

7.7CVSS0.00334EPSS
SaveExploits0References2
NVD
NVD
•added 2022/02/04 11:15 p.m.•60 views

CVE-2022-23590

Tensorflow is an Open Source Machine Learning Framework. A GraphDef from a TensorFlow SavedModel can be maliciously altered to cause a TensorFlow process to crash due to encountering a StatusOr value that is an error and forcibly extracting the value from it. We have patched the issue in multiple...

7.5CVSS0.00973EPSS
SaveExploits1References3
NVD
NVD
•added 2022/01/14 1:15 a.m.•60 views

CVE-2021-38691

A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: Qu...

9.8CVSS0.01296EPSS
SaveExploits0References1
NVD
NVD
•added 2021/11/08 4:15 a.m.•60 views

CVE-2021-31599

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports .prpt file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code...

8.8CVSS0.02266EPSS
SaveExploits3References2
NVD
NVD
•added 2021/09/26 7:15 p.m.•60 views

CVE-2021-41617

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with...

7CVSS0.02545EPSS
SaveExploits2References16
NVD
NVD
•added 2021/08/25 3:15 a.m.•60 views

CVE-2021-39112

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0...

4.9CVSS0.0073EPSS
SaveExploits0References1
NVD
NVD
•added 2021/06/24 12:15 p.m.•60 views

CVE-2021-33604

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 Vaadin 14.0.0 through 14.6.1, 3.0.0 through 6.0.9 Vaadin 15.0.0 through 19.0.8 allows local user to execute arbitrary JavaScript code by opening crafted URL in browser...

2.5CVSS0.00286EPSS
SaveExploits0References2
NVD
NVD
•added 2021/06/17 10:15 p.m.•60 views

CVE-2021-32694

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1...

5.5CVSS0.00967EPSS
SaveExploits1References3
NVD
NVD
•added 2021/06/10 5:15 p.m.•60 views

CVE-2021-31839

Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder. This allows a local user to either add false events or remove events from the event logs prior to them being sent to the ePO server...

4.8CVSS0.00182EPSS
SaveExploits0References1
NVD
NVD
•added 2021/06/10 5:15 p.m.•60 views

CVE-2021-31840

A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local attacker to perform a DLL preloading attack with unsigned DLLs. To exploit this vulnerability, the attacker would need to have valid...

7.3CVSS0.00348EPSS
SaveExploits0References1
NVD
NVD
•added 2021/06/09 8:15 p.m.•60 views

CVE-2021-0052

Incorrect default privileges in the IntelR Computing Improvement Program before version 2.4.6522 may allow an authenticated user to potentially enable an escalation of privilege via local access...

7.8CVSS0.00215EPSS
SaveExploits0References1
NVD
NVD
•added 2021/05/27 12:15 p.m.•60 views

CVE-2021-22892

An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks...

7.5CVSS0.01864EPSS
SaveExploits1References1
NVD
NVD
•added 2021/04/23 4:15 p.m.•60 views

CVE-2020-36321

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder...

7.5CVSS0.01211EPSS
SaveExploits0References2
NVD
NVD
•added 2021/04/13 8:15 p.m.•60 views

CVE-2021-28459

Azure DevOps Server Spoofing Vulnerability...

6.1CVSS0.02317EPSS
SaveExploits3References3
NVD
NVD
•added 2021/03/09 1:15 a.m.•60 views

CVE-2021-24033

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...

6.8CVSS0.03289EPSS
SaveExploits1References2
NVD
NVD
•added 2021/02/16 8:15 p.m.•60 views

CVE-2021-20070

Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.php dialogs...

4.8CVSS0.00468EPSS
SaveExploits0References1
NVD
NVD
•added 2021/02/01 3:15 p.m.•60 views

CVE-2021-21276

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a reque...

9.3CVSS9.2AI score0.07164EPSS
SaveExploits3References4
NVD
NVD
•added 2021/01/11 10:15 p.m.•60 views

CVE-2021-0313

In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions:...

7.8CVSS7.4AI score0.0168EPSS
SaveExploits0References1
NVD
NVD
•added 2020/07/15 9:15 p.m.•60 views

CVE-2020-13788

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

4.3CVSS0.01278EPSS
SaveExploits1References3
NVD
NVD
•added 2020/06/08 2:15 p.m.•60 views

CVE-2020-6110

An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs ...

8.8CVSS8.3AI score0.04264EPSS
SaveExploits1References1
NVD
NVD
•added 2020/01/21 5:15 p.m.•60 views

CVE-2020-6857

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary...

5.5CVSS5.5AI score0.00967EPSS
SaveExploits8References6
NVD
NVD
•added 2019/09/30 12:15 p.m.•60 views

CVE-2019-16676

Plataformatec Simple Form has Incorrect Access Control in filemethod? in lib/simpleform/formbuilder.rb, because a user-supplied string is invoked as a method call...

9.8CVSS9.5AI score0.034EPSS
SaveExploits1References3
NVD
NVD
•added 2019/09/12 2:15 p.m.•60 views

CVE-2019-10400

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts...

4.9CVSS5.1AI score0.01047EPSS
SaveExploits0References2
NVD
NVD
•added 2019/08/09 1:15 p.m.•60 views

CVE-2019-14312

Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI...

6.5CVSS6.3AI score0.20586EPSS
SaveExploits5References2
NVD
NVD
•added 2019/04/20 3:29 p.m.•60 views

CVE-2019-11374

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

8.8CVSS8.6AI score0.09853EPSS
SaveExploits5References3
NVD
NVD
•added 2019/01/15 12:29 a.m.•60 views

CVE-2019-6292

An issue was discovered in singledocparser.cpp in yaml-cpp aka LibYaml-C++ 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, HandleNode. Remote...

6.5CVSS6.2AI score0.01748EPSS
SaveExploits1References1
NVD
NVD
•added 2014/02/11 5:55 p.m.•60 views

CVE-2014-1459

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

6.5CVSS7.9AI score0.02269EPSS
SaveExploits5References7
NVD
NVD
•added 2026/05/22 2:16 a.m.•59 views

CVE-2026-34908

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system...

10CVSS0.85194EPSS
SaveExploits3References3
NVD
NVD
•added 2026/05/15 5:16 p.m.•59 views

CVE-2026-46383

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install on supported Python 3.10 and 3.11 runtimes. When apm install is given a...

5.5CVSS0.0061EPSS
SaveExploits0References1
NVD
NVD
•added 2026/05/13 4:16 p.m.•59 views

CVE-2026-44289

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf...

7.5CVSS0.0058EPSS
SaveExploits0References5
NVD
NVD
•added 2026/05/12 5:16 p.m.•59 views

CVE-2025-35991

Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local...

5.6CVSS0.00095EPSS
SaveExploits0References1
NVD
NVD
•added 2026/05/12 9:16 a.m.•59 views

CVE-2026-6710

The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the SkysaAppsAdminAppPage function. This makes it possible for unauthenticated attackers to trick a site...

4.3CVSS0.00128EPSS
SaveExploits0References5
NVD
NVD
•added 2026/05/12 9:16 a.m.•59 views

CVE-2026-6237

The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

6.4CVSS0.00187EPSS
SaveExploits0References3
NVD
NVD
•added 2026/05/10 1:16 p.m.•59 views

CVE-2022-50947

WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the posttitle parameter. Attackers with editor privileges can inject JavaScript payloads through the...

6.4CVSS0.00197EPSS
SaveExploits0References4
NVD
NVD
•added 2026/05/09 4:16 a.m.•59 views

CVE-2026-42174

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0...

5.3CVSS0.00237EPSS
SaveExploits0References3
NVD
NVD
•added 2026/05/07 10:16 p.m.•59 views

CVE-2026-40213

OpenStack Cyborg before 16.0.1 uses rule:allow checkstr='@' as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complet...

7.4CVSS0.00206EPSS
SaveExploits0References3
NVD
NVD
•added 2026/05/06 8:16 p.m.•59 views

CVE-2026-44109

OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead of rejecting requests, enabling...

9.8CVSS0.00718EPSS
SaveExploits1References3
NVD
NVD
•added 2026/02/09 9:16 a.m.•59 views

CVE-2026-25905

The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing...

5.8CVSS0.00177EPSS
SaveExploits0References1
NVD
NVD
•added 2026/01/29 3:16 p.m.•59 views

CVE-2020-37001

Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overflowing the 'Archive To' input field. Attackers can craft a malicious payload that overwrites the Structured Exception Handler SEH and uses ...

8.4CVSS0.00147EPSS
SaveExploits0References3
NVD
NVD
•added 2025/10/06 8:15 p.m.•59 views

CVE-2025-59447

The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials...

2.2CVSS0.00168EPSS
SaveExploits0References3
NVD
NVD
•added 2025/09/26 4:15 p.m.•59 views

CVE-2025-58385

In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users there is hard-coded and predictable data...

7.1CVSS0.00136EPSS
SaveExploits0References2
NVD
NVD
•added 2025/08/20 6:15 p.m.•59 views

CVE-2025-55746

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files'...

9.3CVSS0.01307EPSS
SaveExploits1References2
NVD
NVD
•added 2025/07/25 3:15 p.m.•59 views

CVE-2025-38423

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9375: Fix double free of regulator supplies Driver gets regulator supplies in probe path with devmregulatorbulkget, so should not call regulatorbulkfree in error and remove paths to avoid double free...

7.8CVSS0.00166EPSS
SaveExploits0References3
NVD
NVD
•added 2025/06/06 11:15 a.m.•59 views

CVE-2025-5757

A vulnerability was found in code-projects Traffic Offense Reporting System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /save-reported.php. The manipulation of the argument...

5.4CVSS0.00262EPSS
SaveExploits1References5
NVD
NVD
•added 2025/05/30 7:15 p.m.•59 views

CVE-2025-48943

vLLM is an inference and serving engine for large language models LLMs. Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service ReDoS that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to...

6.5CVSS0.00417EPSS
SaveExploits0References4
NVD
NVD
•added 2025/05/24 4:15 a.m.•59 views

CVE-2025-4603

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to delete arbitrary files...

9.1CVSS0.01327EPSS
SaveExploits2References7
NVD
NVD
•added 2025/05/02 9:15 p.m.•59 views

CVE-2025-47226

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information...

5CVSS0.01249EPSS
SaveExploits4References4
NVD
NVD
•added 2025/04/30 1:15 a.m.•59 views

CVE-2025-30202

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ for some multi-no...

7.5CVSS0.00569EPSS
SaveExploits1References3
NVD
NVD
•added 2025/04/15 6:15 p.m.•59 views

CVE-2024-50960

A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 =3.01, SMP 351 =2.16, SMP 352 = 2.16, and SME 211 = 3.02, allows a remote authenticated attacker to execute arbitrary commands as root on the underlying operating system...

7.2CVSS0.02272EPSS
SaveExploits2References3
NVD
NVD
•added 2025/03/31 10:15 p.m.•59 views

CVE-2025-31680

Cross-Site Request Forgery CSRF vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0...

6.8CVSS0.00167EPSS
SaveExploits0References1
Total number of security vulnerabilities5000