Export limit exceeded: 366328 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 366328 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 366328 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366328 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-50081 | 1 Oracle | 2 Mysql, Mysql Client | 2025-07-17 | 3.1 Low |
| Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Client accessible data as well as unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N). | ||||
| CVE-2024-6006 | 1 Zkteco | 1 Zkbiosecurity V5000 | 2025-07-17 | 3.5 Low |
| A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The manipulation of the argument Schedule Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has been withdrawn from the market and [is] recommended for upgrading to the ZKBio CVSecurity latest version." This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2024-6005 | 1 Zkteco | 2 Zkbio Cvsecurity V5000, Zkbiosecurity V5000 | 2025-07-17 | 3.5 Low |
| A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Department Section. The manipulation of the argument Department Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has been withdrawn from the market and [is] recommended for upgrading to the ZKBio CVSecurity latest version." This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2024-5936 | 1 Pribai | 1 Privategpt | 2025-07-17 | 6.1 Medium |
| An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability includes potential phishing attacks, malware distribution, and credential theft. | ||||
| CVE-2024-4343 | 2 Imartinez, Pribai | 2 Imartinez Privategpt, Privategpt | 2025-07-17 | 9.8 Critical |
| A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the `eval()` function to parse a string received from a remote AWS SageMaker LLM endpoint into a dictionary. This method of parsing is unsafe as it can execute arbitrary Python code contained within the response. An attacker can exploit this vulnerability by manipulating the response from the AWS SageMaker LLM endpoint to include malicious Python code, leading to potential execution of arbitrary commands on the system hosting the application. The issue is fixed in version 0.6.0. | ||||
| CVE-2024-20867 | 1 Samsung | 2 Email, Samsung Email | 2025-07-17 | 5.5 Medium |
| Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive information. | ||||
| CVE-2024-20868 | 2 Samsung, Samsung Mobile | 2 Notes, Samsung Notes | 2025-07-17 | 4.4 Medium |
| Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege under certain conditions. | ||||
| CVE-2025-20915 | 2 Samsung, Samsung Mobile | 2 Notes, Samsung Notes | 2025-07-17 | 5.5 Medium |
| Out-of-bounds read in applying binary of voice content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. | ||||
| CVE-2025-20914 | 2 Samsung, Samsung Mobile | 2 Notes, Samsung Notes | 2025-07-17 | 5.5 Medium |
| Out-of-bounds read in applying binary of hand writing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. | ||||
| CVE-2025-20913 | 2 Samsung, Samsung Mobile | 2 Notes, Samsung Notes | 2025-07-17 | 5.5 Medium |
| Out-of-bounds read in applying binary of drawing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. | ||||
| CVE-2025-20901 | 1 Samsung | 1 Blockchain Keystore | 2025-07-17 | 4.4 Medium |
| Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory. | ||||
| CVE-2025-20900 | 1 Samsung | 1 Blockchain Keystore | 2025-07-17 | 6.3 Medium |
| Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory. | ||||
| CVE-2025-20898 | 1 Samsung | 1 Members | 2025-07-17 | 4.6 Medium |
| Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles. | ||||
| CVE-2025-20894 | 1 Samsung | 1 Email | 2025-07-17 | 4.6 Medium |
| Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles. | ||||
| CVE-2025-2942 | 2 Tychesoftwares, Wordpress | 2 Order Delivery Date For Woocommerce, Wordpress | 2025-07-17 | 4.3 Medium |
| The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information | ||||
| CVE-2025-28245 | 1 Alteryx | 1 Alteryx Server | 2025-07-17 | 6.1 Medium |
| Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body. | ||||
| CVE-2025-28244 | 1 Alteryx | 1 Alteryx Server | 2025-07-17 | 8.8 High |
| Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover | ||||
| CVE-2025-20949 | 1 Samsung | 1 Members | 2025-07-17 | 5.1 Medium |
| Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members. | ||||
| CVE-2025-20976 | 2 Samsung, Samsung Mobile | 2 Notes, Samsung Notes | 2025-07-17 | 5.5 Medium |
| Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to read out-of-bounds memory. | ||||
| CVE-2025-53886 | 2 Directus, Monospace | 2 Directus, Directus | 2025-07-16 | 4.5 Medium |
| Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue. | ||||