Export limit exceeded: 33686 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 33686 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (33686 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-53398 | 1 Portrait | 2 Dell Color Management, Dell Color Management Application | 2026-01-02 | 7.8 High |
| The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions, | ||||
| CVE-2025-53618 | 2 Grassroots Dicom Project, Malaterre | 2 Grassroots Dicom, Grassroots Dicom | 2026-01-02 | 7.4 High |
| An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `grayscale_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data | ||||
| CVE-2025-53619 | 2 Grassroots Dicom Project, Malaterre | 2 Grassroots Dicom, Grassroots Dicom | 2026-01-02 | 7.4 High |
| An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `null_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data | ||||
| CVE-2025-53919 | 1 Portrait | 2 Dell Color Management, Dell Color Management Application | 2026-01-02 | 7.8 High |
| An issue was discovered in the Portrait Dell Color Management application through 3.3.008 for Dell monitors, It creates a temporary folder, with weak permissions, during installation and uninstallation. A low-privileged attacker with local access could potentially exploit this, leading to elevation of privileges. | ||||
| CVE-2025-51962 | 1 Microstudio | 1 Microstudio | 2026-01-02 | 6.1 Medium |
| A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function. | ||||
| CVE-2025-52196 | 1 Ctera | 2 Ctera, Portal | 2026-01-02 | 7.5 High |
| Server-Side Request Forgery (SSRF) vulnerability in Ctera Portal 8.1.x (8.1.1417.24) allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an iframe. | ||||
| CVE-2025-52582 | 2 Grassroots Dicom Project, Malaterre | 2 Grassroots Dicom, Grassroots Dicom | 2026-01-02 | 7.4 High |
| An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability. | ||||
| CVE-2023-36337 | 1 Inventory Management System Project | 1 Inventory Management System | 2026-01-02 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||||
| CVE-2025-67163 | 1 Simplemachines | 3 Simple Machine Forum, Simple Machines Forum, Smf | 2025-12-31 | 6.1 Medium |
| A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter. | ||||
| CVE-2025-14848 | 1 Advantech | 2 Webaccess/scada, Webaccess\/scada | 2025-12-31 | 4.3 Medium |
| Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. | ||||
| CVE-2025-14849 | 1 Advantech | 2 Webaccess/scada, Webaccess\/scada | 2025-12-31 | 8.8 High |
| Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. | ||||
| CVE-2025-14850 | 1 Advantech | 2 Webaccess/scada, Webaccess\/scada | 2025-12-31 | 8.1 High |
| Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. | ||||
| CVE-2022-1000 | 1 Prasathmani | 1 Tiny File Manager | 2025-12-31 | 9.8 Critical |
| Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7. | ||||
| CVE-2025-46268 | 1 Advantech | 2 Webaccess/scada, Webaccess\/scada | 2025-12-31 | 6.3 Medium |
| Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands. | ||||
| CVE-2025-63948 | 2 Craigtaub, Phpmsadmin | 2 Phpmsadmin, Phpmsadmin | 2025-12-31 | 5.4 Medium |
| A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname parameter, potentially leading to information disclosure or database manipulation. | ||||
| CVE-2025-63949 | 1 Yohanawi | 1 Hotel Management System | 2025-12-31 | 6.1 Medium |
| A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web script via the 'error' parameter in pages/room.php. | ||||
| CVE-2025-63950 | 1 Tomaszdunia | 1 Twittodon | 2025-12-31 | 7.5 High |
| An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28). The 'obj' parameter receives base64-encoded data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, leading to a denial of service. | ||||
| CVE-2025-63951 | 2 Miczflor, Sourcefabric | 2 Rpi-jukebox-rfid, Phoniebox | 2025-12-31 | 7.5 High |
| An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07). The 'rss' GET parameter receives data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, causing the application to process them and leading to errors or a denial of service. | ||||
| CVE-2025-67653 | 1 Advantech | 2 Webaccess/scada, Webaccess\/scada | 2025-12-31 | 4.3 Medium |
| Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. | ||||
| CVE-2025-60541 | 2 Linshenkx, Prompt Optimizer Project | 2 Prompt Optimizer, Prompt Optimizer | 2025-12-31 | 7.3 High |
| A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request. | ||||