Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (29329 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-7543 | 1 Awesomemotive | 1 Duplicator | 2026-02-02 | 6.1 Medium |
| Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter. | ||||
| CVE-2025-59935 | 1 Glpi-project | 1 Glpi | 2026-02-02 | 6.5 Medium |
| GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch. | ||||
| CVE-2025-62408 | 1 C-ares | 1 C-ares | 2026-02-02 | 5.9 Medium |
| c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6. | ||||
| CVE-2025-59947 | 1 Emqx | 1 Nanomq | 2026-01-30 | 9.0 Critical |
| NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription. | ||||
| CVE-2023-3426 | 1 Liferay | 2 Digital Experience Platform, Liferay Portal | 2026-01-30 | 4.3 Medium |
| The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations. | ||||
| CVE-2025-9276 | 2 Cockroach Labs, Cockroachlabs | 2 Cockroach-k8s-request-cert, Cockroach-k8s-request-cert | 2026-01-30 | N/A |
| Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image. The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195. | ||||
| CVE-2022-39314 | 1 Getkirby | 1 Kirby | 2026-01-30 | 3.7 Low |
| Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `password-reset` auth method with the `auth.methods` option or if you have enabled the `debug` option in production. By using two or more IP addresses and multiple login attempts, valid user accounts will lock, but invalid accounts will not, leading to account enumeration. This issue has been patched in versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. If you cannot update immediately, you can work around the issue by setting the `auth.methods` option to `password`, which disables the code-based login and password reset forms. | ||||
| CVE-2024-13086 | 1 Qnap | 2 Qts, Quts Hero | 2026-01-30 | 5.3 Medium |
| An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later QuTS hero h5.2.0.2851 build 20240808 and later | ||||
| CVE-2025-63083 | 1 Joomla | 3 Joomla, Joomla!, Joomla\! | 2026-01-30 | 6.1 Medium |
| Lack of output escaping leads to a XSS vector in the pagebreak plugin. | ||||
| CVE-2025-63082 | 1 Joomla | 3 Joomla, Joomla!, Joomla\! | 2026-01-30 | 6.1 Medium |
| Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. | ||||
| CVE-2025-13086 | 1 Openvpn | 1 Openvpn | 2026-01-30 | 7.5 High |
| Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client | ||||
| CVE-2025-8148 | 1 Fortra | 1 Goanywhere Managed File Transfer | 2026-01-30 | 4.2 Medium |
| An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key. | ||||
| CVE-2025-13744 | 1 Github | 1 Enterprise Server | 2026-01-30 | 5.4 Medium |
| An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML to be rendered by the Filter component (search) across GitHub that could be used to exfiltrate sensitive information. An attacker would require permissions to create or modify the names of milestones, issues, pull requests, or similar entities that are rendered in the vulnerable filter/search components. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.1, and 3.18.2, 3.17.8, 3.16.11, 3.15.15, and 3.14.20. This vulnerability was reported via the GitHub Bug Bounty program. | ||||
| CVE-2025-67158 | 1 Revotech | 2 I6032w-fhw, I6032w-fhw Firmware | 2026-01-30 | 7.5 High |
| An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and escalate privileges via a crafted HTTP request. | ||||
| CVE-2025-67159 | 1 Vatilon | 2 Pa4, Pa4 Firmware | 2026-01-30 | 7.5 High |
| Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. | ||||
| CVE-2025-67160 | 1 Vatilon | 2 Pa4, Pa4 Firmware | 2026-01-30 | 7.5 High |
| An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. | ||||
| CVE-2025-65328 | 1 Mega-fence Project | 1 Mega-fence | 2026-01-30 | 6.5 Medium |
| Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain. An attacker can supply an arbitrary XFF value in a remote request to spoof the client IP, which is then propagated to security-relevant state (e.g., WG_CLIENT_IP cookie). Deployments that rely on this value for IP allowlists may be bypassed. | ||||
| CVE-2025-52519 | 1 Samsung | 16 Exynos, Exynos 1330, Exynos 1330 Firmware and 13 more | 2026-01-30 | 7.1 High |
| An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of user-space input in the issimian device driver leads to information disclosure and a denial of service. | ||||
| CVE-2025-57836 | 2 Microsoft, Samsung | 2 Windows, Magician | 2026-01-30 | 7.8 High |
| An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions during installation, allowing a non-admin user to perform DLL hijacking and escalate privileges. | ||||
| CVE-2025-61781 | 2 Citeum, Opencti-platform | 2 Opencti, Opencti | 2026-01-30 | 7.1 High |
| OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources. An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue. | ||||