Export limit exceeded: 358228 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 358228 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (358228 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-55731 | 1 Frappe | 1 Frappe | 2025-08-22 | 8.8 High |
| Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15. | ||||
| CVE-2025-55732 | 1 Frappe | 1 Frappe | 2025-08-22 | 7.5 High |
| Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests, allowing malicious people to access sensitive information. This vulnerability is a bypass of the official patch released for CVE-2025-52895. This vulnerability is fixed in 15.74.2 and 14.96.15. | ||||
| CVE-2024-51447 | 1 Siemens | 1 Polarion Alm | 2025-08-22 | 5.3 Medium |
| A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected application contains an observable response discrepancy vulnerability when validating usernames. This could allow an unauthenticated remote attacker to distinguish between valid and invalid usernames. | ||||
| CVE-2025-40566 | 1 Siemens | 1 Simatic Pcs Neo | 2025-08-22 | 8.8 High |
| A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. | ||||
| CVE-2025-32917 | 1 Checkmk | 1 Checkmk | 2025-08-22 | 8.8 High |
| Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with write access to JAVA_HOME/bin directory to escalate privileges. | ||||
| CVE-2025-47783 | 1 Humansignal | 1 Label Studio | 2025-08-22 | 6.1 Medium |
| Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. Version 1.18.0 contains a patch for the issue. | ||||
| CVE-2025-2527 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2025-08-22 | 4.3 Medium |
| Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request. | ||||
| CVE-2022-1615 | 3 Fedoraproject, Redhat, Samba | 5 Fedora, Enterprise Linux, Rhel Eus and 2 more | 2025-08-22 | 5.5 Medium |
| In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. | ||||
| CVE-2025-1712 | 1 Checkmk | 1 Checkmk | 2025-08-22 | 8.8 High |
| Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files | ||||
| CVE-2022-31812 | 1 Siemens | 1 Sipass Integrated | 2025-08-22 | 7.5 High |
| A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds read past the end of an allocated buffer while checking the integrity of incoming packets. This could allow an unauthenticated remote attacker to create a denial of service condition. | ||||
| CVE-2025-6124 | 1 Carmelogarcia | 1 Restaurant Order System | 2025-08-22 | 7.3 High |
| A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. This issue affects some unknown processing of the file /tablelow.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-49575 | 2 Starcitizen.tools, Starcitizentools | 2 Citizen, Mediawiki-skins-citizen | 2025-08-22 | 6.5 Medium |
| Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. | ||||
| CVE-2025-49576 | 2 Starcitizen.tools, Starcitizentools | 2 Citizen, Mediawiki-skins-citizen | 2025-08-22 | 6.5 Medium |
| Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1. | ||||
| CVE-2025-49577 | 2 Starcitizen.tools, Starcitizentools | 2 Citizen, Mediawiki-skins-citizen | 2025-08-22 | 6.5 Medium |
| Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1. | ||||
| CVE-2025-49578 | 2 Starcitizen.tools, Starcitizentools | 2 Citizen, Mediawiki-skins-citizen | 2025-08-22 | 6.5 Medium |
| Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. | ||||
| CVE-2025-49579 | 3 Mediawiki, Starcitizen.tools, Starcitizentools | 3 Mediawiki, Citizen, Mediawiki-skins-citizen | 2025-08-22 | 6.5 Medium |
| Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1. | ||||
| CVE-2025-52576 | 1 Kanboard | 1 Kanboard | 2025-08-22 | 5.3 Medium |
| Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine valid usernames and circumvent rate-limiting or blocking mechanisms. Any organization running a publicly accessible Kanboard instance is affected, especially if relying on IP-based protections like Fail2Ban or CAPTCHA for login rate-limiting. Attackers with access to the login page can exploit this flaw to enumerate valid usernames and bypass IP-based blocking mechanisms, putting all user accounts at higher risk of brute-force or credential stuffing attacks. Version 1.2.46 contains a patch for the issue. | ||||
| CVE-2025-33013 | 1 Ibm | 2 Mq Operator, Supplied Mq Advanced Container Images | 2025-08-22 | 6.2 Medium |
| IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release. | ||||
| CVE-2025-36530 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2025-08-22 | 6.8 Medium |
| Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions. | ||||
| CVE-2025-49810 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2025-08-22 | 3.5 Low |
| Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts | ||||