CVE database
94,291 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 7.5 High severity
SemanticMediaWiki: Uncontrolled Resource Consumption
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requ
- 7.1 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater app
- 7.3 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-job
- 7.5 High severity
SemanticMediaWiki: Inefficient Algorithmic Complexity
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many disti
- 7.5 High severity
SemanticMediaWiki: Uncontrolled Recursion
Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to
- 8.7 High severity
Octopus Server: Improper Validation of Unsafe Equivalence in Input
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate t
- 9.4 Critical severity
JP1/Integrated Management 3 - Manager: Out-of-bounds Write
Out-of-bounds Write Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent:
- 9.4 Critical severity
JP1/Integrated Management 3 - Manager: Heap-based Buffer Overflow
Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 -
- 9.4 Critical severity
JP1/Integrated Management 3 - Manager: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3
- 8.3 High severity
Compute Engine: Missing Authorization
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vu
- 9.4 Critical severity
HiRDB Server Version 10: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB
- 7.5 High severity
HiRDB Server Version 10: Origin Validation Error
Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Serv
- 9.8 Critical severity
HiRDB Server Version 10: Heap-based Buffer Overflow
Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB S
- 9.8 Critical severity
HiRDB Server Version 10: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server
- 9.8 Critical severity
HiRDB Server Version 10: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB
- 9.8 Critical severity
HiRDB Server Version 10: Authentication Bypass by Spoofing
Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V;
- 9.8 Critical severity
HiRDB Server Version 10: Missing Authentication for Critical Functionality
Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 throug
- 9.8 Critical severity
JP1/Automatic Job Management System 3 - Manager: Heap-based Buffer Overflow
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- 9.8 Critical severity
JP1/Automatic Job Management System 3 - Manager: Authentication Bypass by Spoofing
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- 9.4 Critical severity
JP1/Automatic Job Management System 3 - Manager: Heap-based Buffer Overflow
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- 9.4 Critical severity
JP1/Automatic Job Management System 3 - Manager: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- 9.4 Critical severity
JP1/Automatic Job Management System 3 - Manager: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- 9.8 Critical severity
JP1/Automatic Job Management System 3 - Manager: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- 9.4 Critical severity
JP1/Automatic Job Management System 3 - Manager: Heap-based Buffer Overflow
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- 9.4 Critical severity
JP1/Automatic Job Management System 3 - Manager: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- 8.3 High severity
Cloud BI Platform: Improper Neutralization of Input During Web Page Generation
Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an authenticated user with the Designer or Administrator role to execute JavaScript code in the browser of another user who
- 9.3 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHe
- 9.3 Critical severity
Gridbox extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the paramet
- 9.8 Critical severity
Qode Membership: Improper Authentication
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Faceboo
- 7.2 High severity
MBD-X12SPI: Improper Authentication
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- 8.8 High severity
MBD-X12SPI: Improper Privilege Management
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- 7.4 High severity
MBD-X12SPI: Incorrect Behavior Order
A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
- 9.8 Critical severity
X12SPI: Missing Authentication for Critical Functionality
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- 7.5 High severity
X12SPI: Use of Hard-coded Credentials
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- 7.2 High severity
MBD-X12STW-F: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.
- 7.5 High severity
OnCell G3150A-LTE Series: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management function
- 7.7 High severity
OnCell G3150A-LTE Series: Use of Hard-coded Cryptographic Key
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerate
- 7.6 High severity
Moxa Remote Connect Suite (MRC Client): Improper Certificate Validation
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted
- 8.8 High severity
Kirki – Freeform Page Builder, Website Builder…: Deserialization of Untrusted Data
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due
- 7.5 High severity
FortiOS: Improper Locking
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.