Export limit exceeded: 367035 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 367035 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (367035 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-29448 | 1 Easyappointments | 1 Easy\!appointments | 2026-01-28 | 7.5 High |
| Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability. | ||||
| CVE-2025-22603 | 2 Agpt, Significant-gravitas | 2 Autogpt Platform, Autogpt | 2026-01-28 | 8.1 High |
| AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery (SSRF) vulnerability inside component (or block) `Send Web Request`. The root cause is that IPV6 address is not restricted or filtered, which allows attackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue. | ||||
| CVE-2025-63388 | 2 Dify, Langgenius | 2 Dify, Dify | 2026-01-28 | 9.1 Critical |
| A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests." | ||||
| CVE-2025-27063 | 1 Qualcomm | 223 Csra6620, Csra6620 Firmware, Csra6640 and 220 more | 2026-01-28 | 7.8 High |
| Memory corruption during video playback when video session open fails with time out error. | ||||
| CVE-2025-47319 | 1 Qualcomm | 237 Ar8035, Ar8035 Firmware, Fastconnect 6200 and 234 more | 2026-01-28 | 6.7 Medium |
| Information disclosure while exposing internal TA-to-TA communication APIs to HLOS | ||||
| CVE-2025-47322 | 1 Qualcomm | 223 Ar8031, Ar8031 Firmware, Ar8035 and 220 more | 2026-01-28 | 7.8 High |
| Memory corruption while handling IOCTL calls to set mode. | ||||
| CVE-2025-47323 | 1 Qualcomm | 357 Ar8035, Ar8035 Firmware, Csra6620 and 354 more | 2026-01-28 | 7.8 High |
| Memory corruption while routing GPR packets between user and root when handling large data packet. | ||||
| CVE-2025-47330 | 1 Qualcomm | 447 Ar8031, Ar8031 Firmware, Ar8035 and 444 more | 2026-01-28 | 5.5 Medium |
| Transient DOS while parsing video packets received from the video firmware. | ||||
| CVE-2025-47331 | 1 Qualcomm | 599 Ar8031, Ar8031 Firmware, Ar8035 and 596 more | 2026-01-28 | 6.1 Medium |
| Information disclosure while processing a firmware event. | ||||
| CVE-2025-47333 | 1 Qualcomm | 479 Aqt1000, Aqt1000 Firmware, Ar8031 and 476 more | 2026-01-28 | 6.6 Medium |
| Memory corruption while handling buffer mapping operations in the cryptographic driver. | ||||
| CVE-2025-47348 | 1 Qualcomm | 409 Aqt1000, Aqt1000 Firmware, Ar8035 and 406 more | 2026-01-28 | 7.8 High |
| Memory corruption while processing identity credential operations in the trusted application. | ||||
| CVE-2022-36943 | 1 Ziparchive Project | 1 Ziparchive | 2026-01-28 | 8.1 High |
| SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item. | ||||
| CVE-2025-47382 | 1 Qualcomm | 199 Fastconnect 6200, Fastconnect 6200 Firmware, Fastconnect 6700 and 196 more | 2026-01-28 | 7.8 High |
| Memory corruption while loading an invalid firmware in boot loader. | ||||
| CVE-2025-47387 | 1 Qualcomm | 91 Aqt1000, Aqt1000 Firmware, Fastconnect 6200 and 88 more | 2026-01-28 | 7.8 High |
| Memory Corruption when processing IOCTLs for JPEG data without verification. | ||||
| CVE-2025-47332 | 1 Qualcomm | 149 Fastconnect 6200, Fastconnect 6200 Firmware, Fastconnect 6700 and 146 more | 2026-01-28 | 6.7 Medium |
| Memory corruption while processing a config call from userspace. | ||||
| CVE-2025-13053 | 1 Asustor | 2 Adm, Data Master | 2026-01-28 | 3.7 Low |
| When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffic between the client and server can perform a man-in-the-middle (MITM) attack, which may obtain the sensitive information of the UPS server configuation. This issue affects ADM: from 4.1.0 through 4.3.3.RKD2, from 5.0.0 through 5.1.0.RN42. | ||||
| CVE-2025-13052 | 1 Asustor | 2 Adm, Data Master | 2026-01-28 | 5.9 Medium |
| When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traffic between the SMTP client and server to execute a man-in-the-middle (MITM) attack, which may obtain the sensitive information of the SMTP. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RKD2 as well as from ADM 5.0.0 through ADM 5.1.0.RN42. | ||||
| CVE-2025-12793 | 1 Asus | 2 Asussoftwaremanageragent, Myasus | 2026-01-28 | 7.8 High |
| An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution. Refer to the ' Security Update for MyASUS' section on the ASUS Security Advisory for more information. | ||||
| CVE-2025-36911 | 1 Google | 1 Android | 2026-01-28 | 7.1 High |
| In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2023-0507 | 2 Grafana, Redhat | 2 Grafana, Ceph Storage | 2026-01-28 | 7.3 High |
| Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix. | ||||