Export limit exceeded: 360814 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (360814 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-40960 | 1 Luanti | 1 Luanti | 2026-04-17 | 8.1 High |
| Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods or secure.http_mods, then a crafted mod can intercept the request for the insecure environment or HTTP API, and also receive access to it. | ||||
| CVE-2026-40959 | 1 Luanti | 1 Luanti | 2026-04-17 | 9.3 Critical |
| Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod. | ||||
| CVE-2023-3634 | 1 Festo | 24 Mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd, Mse6-c2m-5000-fb36-d-m-rg-bar-m12l4-agd Firmware, Mse6-c2m-5000-fb36-d-m-rg-bar-m12l5-agd and 21 more | 2026-04-17 | 8.8 High |
| In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability. | ||||
| CVE-2023-5872 | 1 Wago | 1 Smart Designer | 2026-04-17 | 4.3 Medium |
| In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint. | ||||
| CVE-2024-58343 | 1 Vision | 1 Helpdesk | 2026-04-17 | 4.3 Medium |
| Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id. | ||||
| CVE-2025-63743 | 1 Grokability | 1 Snipe-it | 2026-04-17 | 5.4 Medium |
| Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is executed whenever "Activity Report" or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile's "Display Name" is not set. The vulnerability is fixed in v8.3.2. | ||||
| CVE-2025-70023 | 1 Transloadit | 1 Uppy | 2026-04-17 | 9.8 Critical |
| An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6. | ||||
| CVE-2026-0207 | 1 Purestorage | 1 Flashblade | 2026-04-17 | N/A |
| A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions. | ||||
| CVE-2026-0209 | 1 Purestorage | 1 Flasharray | 2026-04-17 | N/A |
| Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured. | ||||
| CVE-2026-22676 | 1 Barracuda Networks | 1 Rmm | 2026-04-17 | 7.8 High |
| Barracuda RMM versions prior to 2025.2.2 contain a privilege escalation vulnerability that allows local attackers to gain SYSTEM-level privileges by exploiting overly permissive filesystem ACLs on the C:\Windows\Automation directory. Attackers can modify existing automation content or place attacker-controlled files in this directory, which are then executed under the NT AUTHORITY\SYSTEM account during routine automation cycles, typically succeeding within the next execution cycle. | ||||
| CVE-2026-22734 | 1 Cloudfoundry | 2 Cf-deployment, Uaa | 2026-04-17 | 8.6 High |
| Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive). | ||||
| CVE-2026-30993 | 1 Slah Cms | 1 Slah Cms | 2026-04-17 | 9.8 Critical |
| Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input. | ||||
| CVE-2026-30995 | 1 Slah Cms | 1 Slah Cms | 2026-04-17 | 8.6 High |
| Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint. | ||||
| CVE-2026-30994 | 1 Slah Cms | 1 Slah Cms | 2026-04-17 | 7.5 High |
| Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active session credentials. | ||||
| CVE-2026-29628 | 1 Kiyochii | 1 Tinyobjloader | 2026-04-17 | 6.2 Medium |
| A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service (DoS) via supplying a crafted .mtl file. | ||||
| CVE-2026-1462 | 2 Keras, Redhat | 2 Keras, Openshift Ai | 2026-04-17 | 7.8 High |
| A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the `from_config()` method. | ||||
| CVE-2026-39940 | 1 Churchcrm | 1 Churchcrm | 2026-04-17 | N/A |
| ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For this write-up the DonatedItemEditor.php will be used as an example, however wherever all instances of 'linkBack' should be assessed. This vulnerability is fixed in 7.0.0. | ||||
| CVE-2026-38528 | 1 Krayin | 1 Laravel-crm | 2026-04-17 | 7.1 High |
| Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php. | ||||
| CVE-2026-38527 | 1 Krayin | 1 Laravel-crm | 2026-04-17 | 8.5 High |
| A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request. | ||||
| CVE-2025-51414 | 1 Phpgurukul | 1 Online Course Registration | 2026-04-17 | 8.8 High |
| In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page. | ||||