CVE database
94,255 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 7.5 High severity
SonicOS: Heap-based Buffer Overflow
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
- 10.0 Critical severity
wanderer: Server-Side Request Forgery
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to even
- 7.6 High severity
wanderer: Improper Neutralization of Input During Web Page Generation
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src
- 7.6 High severity
wanderer: Improper Neutralization of Input During Web Page Generation
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unval
- 7.5 High severity
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Exploited
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor auth
- 8.3 High severity
VIDAA: Improper Restriction of Excessive Authentication Attempts
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate li
- 8.8 High severity
VIDAA: Missing Authentication for Critical Functionality
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authenti
- 7.5 High severity
grobid: Uncontrolled Resource Consumption
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates Ex
- 8.1 High severity
babelfish-for-postgresql: Out-of-bounds Read
An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent p
- 9.8 Critical severity
babelfish-for-postgresql: Heap-based Buffer Overflow
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS command
- 8.8 High severity
SonicOS: Permissive Cross-domain Security Policy with Untrusted Domains
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- 8.8 High severity
SonicOS: Reliance on IP Address for Authentication
A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- 7.5 High severity
DataMiner: Missing Authentication for Critical Functionality
Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unre
- 7.5 High severity
freescout: Improper Neutralization of Input During Web Page Generation
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serial
- 7.5 High severity
wanderer: Authorization Bypass Through User-Controlled Key
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and c
- 8.8 High severity
Viewers: Improper Neutralization of Input During Web Page Generation
OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/ge
- 7.5 High severity
content: Uncontrolled Resource Consumption
Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.pos
- 7.5 High severity
kroki: Improper Limitation of a Pathname to a Restricted Directory
Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \read, \input, and \incl
- 8.2 High severity
freescout: Server-Side Request Forgery
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforce
- 7.7 High severity
freescout: Improper Neutralization of Special Elements used in an SQL Command
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes.
- 7.6 High severity
freescout: Improper Neutralization of Input During Web Page Generation
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting
- 8.4 High severity
FreedomBox: UNIX Symbolic Link (Symlink) Following
In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debia
- 8.1 High severity
Snowflake Connector for Python: Improper Neutralization of Special Elements used in an SQL Command
When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before i
- 9.9 Critical severity
trusted-remote-execution: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root
- 8.4 High severity
symfony: External Control of File Name or Path
The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-c
- 7.5 High severity
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on…
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On ma
- 7.3 High severity
Progress® Telerik® Fiddler® Everywhere: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
- 7.1 High severity
freescout: Improper Privilege Management
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checkin
- 9.8 Critical severity
Apache Axis 1.x (EOL): Use of Externally-Controlled Input to Select Classes or Code
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> ele
- 8.8 High severity
Avast Antivirus, Avast One, Avast Premium…: Unrestricted Upload of File with Dangerous Type
Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host. The sandbox virtualizes fil
- 8.8 High severity
Avast Antivirus, Avast One, Avast Premium…: Improper Handling of Insufficient Permissions or Privileges
Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox. T
- 7.6 High severity
dify: Server-Side Request Forgery
Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configurati
- 8.7 High severity
symfony: Inefficient Algorithmic Complexity
The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in
- 8.3 High severity
Internet of Agents: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argumen
- 8.2 High severity
symfony: Improper Limitation of a Pathname to a Restricted Directory
The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensitive regular expression, allowing a value with an uppercase scheme, such as DATA:,/../../../etc/passwd, to bypass it, resulting in Arbitrary Local File
- 7.5 High severity
zephyr: NULL Pointer Dereference
The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of every frame. handle_http_frame_header() executed client->current_stream = NULL unconditionally, but a CONTINUATION frame does not open a new str
- 7.3 High severity
EasyIO Neo IOManager and Tools Installer: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.
- 9.8 Critical severity
Jumis: Use of Hard-coded, Security-relevant Constants
Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in th
- 8.1 High severity
wish: Improper Limitation of a Pathname to a Restricted Directory
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-sl
- 8.5 High severity
agenta: Server-Side Request Forgery
Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorizat