Lucene search
+L
NvdMost viewed

398651 matches found

NVD
NVD
•added 2026/05/18 3:16 p.m.•67 views

CVE-2026-41949

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the...

8.2CVSS0.00566EPSS
SaveExploits1References6
NVD
NVD
•added 2026/05/14 7:16 p.m.•67 views

CVE-2026-22707

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions plugin.upload.security.allowedTypes and deniedTypes. The same restrictions were correctly...

5.4CVSS0.00195EPSS
SaveExploits0References1
NVD
NVD
•added 2026/05/14 3:16 p.m.•67 views

CVE-2026-44216

Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is...

7.5CVSS0.00581EPSS
SaveExploits0References5
NVD
NVD
•added 2026/05/12 9:16 a.m.•67 views

CVE-2026-5028

The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the pp-get-articles AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...

6.5CVSS0.00399EPSS
SaveExploits0References3
NVD
NVD
•added 2026/05/07 3:16 p.m.•67 views

CVE-2025-63705

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...

8.8CVSS0.01185EPSS
SaveExploits0References2
NVD
NVD
•added 2026/05/05 5:16 a.m.•67 views

CVE-2026-4362

The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the LiveAction::reset function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress init action and triggers when both post...

6.5CVSS0.0059EPSS
SaveExploits0References6
NVD
NVD
•added 2026/04/15 7:16 p.m.•67 views

CVE-2026-6245

A flaw was found in the System Security Services Daemon SSSD. The pampasskeychildreaddata function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an...

5.5CVSS0.00149EPSS
SaveExploits0References2
NVD
NVD
•added 2026/03/23 10:16 p.m.•67 views

CVE-2025-60946

Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha...

8.8CVSS0.00488EPSS
SaveExploits0References4
NVD
NVD
•added 2026/03/11 6:17 a.m.•67 views

CVE-2023-27573

netbox-docker before 2.5.0 has a superuser account with default credentials admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSERAPITOKEN. In practice on the public Internet, almost all users changed the password but only about 90% changed the toke...

9.8CVSS0.00493EPSS
SaveExploits1References3
NVD
NVD
•added 2026/02/05 6:16 p.m.•67 views

CVE-2025-58190

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

5.3CVSS0.00512EPSS
SaveExploits1References4
NVD
NVD
•added 2026/01/28 8:16 p.m.•67 views

CVE-2023-37525

A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals...

5.3CVSS0.0034EPSS
SaveExploits0References1
NVD
NVD
•added 2025/10/29 5:15 p.m.•67 views

CVE-2025-12477

Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

10CVSS0.00324EPSS
SaveExploits0References1
NVD
NVD
•added 2025/09/25 12:15 p.m.•67 views

CVE-2025-10943

A security flaw has been discovered in MikeCen WeChat-Face-Recognition up to 6e3f72bf8547d80b59e330f1137e4aa505f492c1. This vulnerability affects the function valid of the file wx.php. The manipulation of the argument echostr results in cross site scripting. The attack can be launched remotely...

5.1CVSS0.00253EPSS
SaveExploits0References4
NVD
NVD
•added 2025/09/16 10:15 p.m.•67 views

CVE-2025-9708

A vulnerability exists in the Kubernetes C client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority CA without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially...

6.8CVSS0.00309EPSS
SaveExploits0References3
NVD
NVD
•added 2025/08/26 4:15 p.m.•67 views

CVE-2025-57813

traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an...

5.9CVSS0.00416EPSS
SaveExploits0References3
NVD
NVD
•added 2025/07/28 2:15 p.m.•67 views

CVE-2025-8279

Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution...

9.8CVSS0.00415EPSS
SaveExploits0References1
NVD
NVD
•added 2025/07/09 4:15 p.m.•67 views

CVE-2025-53660

Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

4.3CVSS0.00243EPSS
SaveExploits0References2
NVD
NVD
•added 2025/06/09 6:15 p.m.•67 views

CVE-2025-49651

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI...

8.1CVSS0.00338EPSS
SaveExploits0References1
NVD
NVD
•added 2025/05/08 2:15 p.m.•67 views

CVE-2025-47729

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL aka Archive Signal app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as...

4.9CVSS0.00428EPSS
SaveExploits0References4
NVD
NVD
•added 2025/02/16 9:15 a.m.•67 views

CVE-2025-1336

A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimgaction in the library lib/admin/imageadmin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The explo...

8.1CVSS0.01033EPSS
SaveExploits1References4
NVD
NVD
•added 2025/02/07 4:15 p.m.•67 views

CVE-2024-57248

Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of Privileges via injecting malicious payloads in HTTP requests to manipulate file paths, bypass access controls, and upload malicious files...

6.3CVSS0.03206EPSS
SaveExploits3References2
NVD
NVD
•added 2025/01/21 9:15 p.m.•67 views

CVE-2025-21502

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Orac...

4.8CVSS0.01007EPSS
SaveExploits0References5
NVD
NVD
•added 2025/01/21 6:15 p.m.•67 views

CVE-2024-54794

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution...

9.1CVSS0.12829EPSS
SaveExploits3References2
NVD
NVD
•added 2025/01/15 10:15 p.m.•67 views

CVE-2025-0491

A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. Affected is an unknown function of the file /fladmin/catdodel.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed...

9.8CVSS0.00599EPSS
SaveExploits1References5
NVD
NVD
•added 2025/01/06 7:15 p.m.•67 views

CVE-2024-35498

A cross-site scripting XSS vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

6.1CVSS0.00377EPSS
SaveExploits1References2
NVD
NVD
•added 2025/01/02 4:15 p.m.•67 views

CVE-2024-12907

Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint. Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this...

5.3CVSS0.00393EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/17 9:15 p.m.•67 views

CVE-2024-11993

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field...

6.1CVSS0.00335EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/06 4:15 p.m.•67 views

CVE-2024-54745

WAVLINK WN701AE M01AEV240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root...

9.8CVSS0.00559EPSS
SaveExploits1References2
NVD
NVD
•added 2024/12/04 9:15 p.m.•67 views

CVE-2024-38829

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase and...

3.7CVSS0.00371EPSS
SaveExploits0References1
NVD
NVD
•added 2024/10/28 1:15 a.m.•67 views

CVE-2024-50067

In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-space strings, arrays can be very large,...

7.8CVSS0.00235EPSS
SaveExploits0References5
NVD
NVD
•added 2024/10/02 8:15 p.m.•67 views

CVE-2024-46977

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

6.5CVSS0.00912EPSS
SaveExploits0References3
NVD
NVD
•added 2024/10/02 5:15 p.m.•67 views

CVE-2024-20523

A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service DoS condition. To exploit...

6.8CVSS0.00476EPSS
SaveExploits0References1
NVD
NVD
•added 2024/09/27 6:15 p.m.•67 views

CVE-2024-46256

A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate...

9.8CVSS0.03084EPSS
SaveExploits2References4
NVD
NVD
•added 2024/09/26 6:15 p.m.•67 views

CVE-2024-47124

The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous versions of the app and update your app to the current app version which uses AES-256 encryption for callsigns in encrypted operation...

6.5CVSS0.00095EPSS
SaveExploits0References1
NVD
NVD
•added 2024/09/25 5:15 p.m.•67 views

CVE-2024-20510

A vulnerability in the Central Web Authentication CWA feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent attacker to bypass the pre-authentication access control list ACL, which could allow access to network resources before user authentication. Thi...

9.3CVSS0.00276EPSS
SaveExploits0References1
NVD
NVD
•added 2024/09/20 8:15 a.m.•67 views

CVE-2024-8853

The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restriction on the 'doSsoAuthentification' function. This makes it possible for unauthenticated attackers to make themselves administrators by registering with a...

9.8CVSS0.00642EPSS
SaveExploits0References3
NVD
NVD
•added 2024/09/18 6:15 p.m.•67 views

CVE-2024-46986

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on...

9.9CVSS0.40956EPSS
SaveExploits2References5
NVD
NVD
•added 2024/09/13 3:15 p.m.•67 views

CVE-2024-5789

The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

6.4CVSS0.00272EPSS
SaveExploits0References2
NVD
NVD
•added 2024/08/21 2:15 p.m.•67 views

CVE-2024-8007

A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform RHOSP director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a...

8.1CVSS0.00392EPSS
SaveExploits0References4
NVD
NVD
•added 2024/08/08 2:15 a.m.•67 views

CVE-2024-21302

Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this...

6.7CVSS0.01572EPSS
SaveExploits0References1
NVD
NVD
•added 2024/07/30 9:15 p.m.•67 views

CVE-2024-5901

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

6.4CVSS0.00393EPSS
SaveExploits0References3
NVD
NVD
•added 2024/07/27 12:15 p.m.•67 views

CVE-2024-6627

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all versions up to, and including, 3.11.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

6.4CVSS0.00329EPSS
SaveExploits0References4
NVD
NVD
•added 2024/07/24 5:15 p.m.•67 views

CVE-2024-41110

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins AuthZ under specific circumstances. The base likelihood of this being...

9.9CVSS0.16496EPSS
SaveExploits0References14
NVD
NVD
•added 2024/07/24 8:15 a.m.•67 views

CVE-2023-32471

Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds read vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability to read contents of stack memory and use this information for further exploits...

6CVSS0.00167EPSS
SaveExploits0References1
NVD
NVD
•added 2024/07/10 7:15 p.m.•67 views

CVE-2024-6235

Sensitive information disclosure in NetScaler Console...

9.4CVSS0.21168EPSS
SaveExploits0References1
NVD
NVD
•added 2024/07/09 12:15 p.m.•67 views

CVE-2024-3596

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature...

9CVSS0.14859EPSS
SaveExploits2References13
NVD
NVD
•added 2024/06/18 5:15 p.m.•67 views

CVE-2024-21685

This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information Disclosur...

7.4CVSS0.00439EPSS
SaveExploits0References2
NVD
NVD
•added 2024/06/10 8:15 p.m.•67 views

CVE-2024-36412

SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue...

10CVSS0.05692EPSS
SaveExploits1References1
NVD
NVD
•added 2024/06/05 1:15 p.m.•67 views

CVE-2024-3469

The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

6.1CVSS6AI score0.00637EPSS
SaveExploits0References2
NVD
NVD
•added 2024/04/10 6:15 p.m.•67 views

CVE-2024-31214

Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file...

9.6CVSS9.5AI score0.17631EPSS
SaveExploits5References4
Total number of security vulnerabilities5000