Export limit exceeded: 43033 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (43033 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-14647 | 2 Carmelo, Code-projects | 2 Computer Book Store, Computer Book Store | 2025-12-22 | 7.3 High |
| A weakness has been identified in code-projects Computer Book Store 1.0. Affected is an unknown function of the file /admin_delete.php. This manipulation of the argument bookisbn causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. | ||||
| CVE-2025-12994 | 1 Medtronic | 1 Carelink Network | 2025-12-22 | 5.3 Medium |
| Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025. | ||||
| CVE-2025-12995 | 1 Medtronic | 1 Carelink Network | 2025-12-22 | 8.1 High |
| Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025. | ||||
| CVE-2025-12996 | 1 Medtronic | 1 Carelink Network | 2025-12-22 | 4.1 Medium |
| Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025. | ||||
| CVE-2025-12997 | 1 Medtronic | 1 Carelink Network | 2025-12-22 | 2.2 Low |
| Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025. | ||||
| CVE-2019-10648 | 1 Robocode | 1 Robocode | 2025-12-22 | N/A |
| Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL. | ||||
| CVE-2025-50401 | 2 Mercurycom, Mercusys | 4 D196g, D196g Firmware, Mercury D196g and 1 more | 2025-12-22 | 9.8 Critical |
| Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the parameter password. | ||||
| CVE-2025-50398 | 2 Mercurycom, Mercusys | 4 D196g, D196g Firmware, Mercury D196g and 1 more | 2025-12-22 | 9.8 Critical |
| Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the parameter fac_password. | ||||
| CVE-2025-64131 | 1 Jenkins | 2 Jenkins, Saml | 2025-12-22 | 7.5 High |
| Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user. | ||||
| CVE-2021-32837 | 1 Mechanize Project | 1 Mechanize | 2025-12-22 | 7.5 High |
| mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue. | ||||
| CVE-2025-67906 | 1 Misp | 1 Misp | 2025-12-21 | 5.4 Medium |
| In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. | ||||
| CVE-2025-37948 | 2 Debian, Linux | 2 Debian Linux, Linux Kernel | 2025-12-20 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit from a BPF program, emit the BHB mititgation sequence. This is only applied for 'classic' cBPF programs that are loaded by seccomp. | ||||
| CVE-2025-14649 | 2 Admerc, Itsourcecode | 2 Online Cake Ordering System, Online Cake Ordering System | 2025-12-19 | 7.3 High |
| A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /cakeshop/supplier.php. Performing manipulation of the argument supplier results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. | ||||
| CVE-2025-4363 | 1 Admerc | 1 Gym Management System | 2025-12-19 | 7.3 High |
| A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=end_membership. The manipulation of the argument rid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2018-7046 | 1 Kentico | 1 Xperience | 2025-12-19 | N/A |
| Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout | ||||
| CVE-2018-7205 | 1 Kentico | 1 Xperience | 2025-12-19 | N/A |
| Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout | ||||
| CVE-2022-32387 | 1 Kentico | 1 Xperience | 2025-12-19 | 7.5 High |
| In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler. | ||||
| CVE-2019-10068 | 1 Kentico | 1 Xperience | 2025-12-19 | 9.8 Critical |
| An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted. | ||||
| CVE-2023-29144 | 2 Linux, Malwarebytes | 2 Linux, Malwarebytes | 2025-12-19 | 3.3 Low |
| Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection. | ||||
| CVE-2025-67344 | 1 Jishenghua | 1 Jsherp | 2025-12-19 | 4.6 Medium |
| jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint. | ||||