146895+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the …
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. …
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. …
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. …
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. …
B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers …
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. …
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in …
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when …
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers …
Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary …
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. …
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by …
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp …
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. …
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through …
Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration …
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from …
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing …
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. …
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation …
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. …
A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. …
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to …
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database …
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to …
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled …
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into …
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 …
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by …
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has …
Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it …
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c …
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping …
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> …
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from …
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional …
During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an …
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers …
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git …
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and …
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow …
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths …
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them …
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values …
Free website and port scanning — find vulnerabilities before attackers do.