CVE database
94,255 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 8.1 High severity
XWEB EVO: Use of Insufficiently Random Values
XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze t
- 9.8 Critical severity
XWEB EVO: Use of Hard-coded Credentials
XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevon
- 7.8 High severity
XWEB EVO: Execution with Unnecessary Privileges
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitr
- 9.8 Critical severity
XWEB EVO: Improper Neutralization of Special Elements used in an OS Command
XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua,
- 7.1 High severity
Red Hat Satellite 6.16 for RHEL 8: Authorization Bypass Through User-Controlled Key
A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that auth
- 7.7 High severity
Red Hat Satellite 6.16 for RHEL 8: Missing Authorization
A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fi
- 9.6 Critical severity
Red Hat Satellite 6.16 for RHEL 8: Permissive List of Allowed Inputs
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods
- 7.1 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Authentication
An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts.
- 7.0 High severity
Vivado Software: Incorrect Default Permissions
Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution.
- 8.8 High severity
Red Hat Enterprise Linux 10: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize
- 7.1 High severity
AcyMailing extension for Joomla and WordPress: Authorization Bypass Through User-Controlled Key
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of
- 8.2 High severity
jDownloads extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to b
- 7.0 High severity
AMD EPYC™ 7003 Series Processors: Improper Check for Unusual or Exceptional Conditions
Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Cache (ATC), potentially resulting in denial of service.
- 7.5 High severity
Payment Gateway for PayPal Pro, PayPal…: Insufficient Verification of Data Authenticity
WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which is gated only by a public chec
- 9.3 Critical severity
RMM+: Use of Default Credentials
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, incl
- 8.8 High severity
pgedge-postgres-mcp: Improper Neutralization of Special Elements used in an SQL Command
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An ar
- 8.1 High severity
pgedge-postgres-mcp: Improper Neutralization of Special Elements used in an SQL Command
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters,
- 7.8 High severity
Telerik UI for WPF: URL Redirection to Untrusted Site
In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with
- 7.8 High severity
Telerik UI for WinForms: URL Redirection to Untrusted Site
In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks
- 8.8 High severity
AcyMailing extension for Joomla and WordPress: Missing Authorization
Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every
- 7.0 High severity
Akaunting: Improper Neutralization of Input During Web Page Generation
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recu
- 8.8 High severity
AcyMailing extension for Joomla and WordPress: Exposure of Sensitive Information to an Unauthorized Actor
Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker
- 10.0 Critical severity
jDownloads extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution.
- 7.1 High severity
jDownloads extension for Joomla: Improper Access Control
Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automat
- 8.9 High severity
jDownloads extension for Joomla: Server-Side Request Forgery
Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise
- 7.1 High severity
Elasticsearch Datasource: Improper Limitation of a Pathname to a Restricted Directory
The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappin
- 8.6 High severity
Telerik UI for ASP.NET Core: Uncontrolled Recursion
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does no
- 8.6 High severity
Telerik UI for ASP.NET MVC: Uncaught Exception
In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within th
- 8.4 High severity
Plesk: Incorrect Permission Assignment for Critical Resource
The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake reques
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking
- 7.4 High severity
Node.js Driver: Incorrect Behavior Order: Validate Before Canonicalize
A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the do
- 7.5 High severity
soupsieve: Inefficient Regular Expression Complexity
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of a
- 7.5 High severity
soupsieve: Inefficient Algorithmic Complexity
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the wo
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may comprom
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a us
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form.
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts
- 7.9 High severity
Red Hat Enterprise Linux 10: Exposure of Private Personal Information to an Unauthorized Actor
A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type G