CVE-2026-28552 | Medium | 6.5 | 2026-03-05 | Out-of-bounds write vulnerability in the IMS module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28539 | Medium | 6.2 | 2026-03-05 | Data processing vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-20311 | High | 7.4 | 2025-09-24 | A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent… |
CVE-2023-39395 | High | 7.5 | 2023-08-13 | Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability. |
CVE-2021-0263 | Medium | 5.9 | 2021-04-22 | A Data Processing vulnerability in the Multi-Service process (multi-svcs) on the FPC of Juniper Networks Junos OS on the PTX Series routers may lead to the pro… |
CVE-2020-3414 | High | 8.6 | 2020-09-24 | A vulnerability in the packet processing of Cisco IOS XE Software for Cisco 4461 Integrated Services Routers could allow an unauthenticated, remote attacker to… |
CVE-2020-1651 | Medium | 6.5 | 2020-07-17 | On Juniper Networks MX series, receipt of a stream of specific Layer 2 frames may cause a memory leak resulting in the packet forwarding engine (PFE) on the li… |
CVE-2020-3232 | High | 7.7 | 2020-06-03 | A vulnerability in the Simple Network Management Protocol (SNMP) implementation in Cisco ASR 920 Series Aggregation Services Router model ASR920-12SZ-IM could… |
CVE-2019-14794 | High | 7.5 | 2019-08-09 | The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. |
CVE-2019-13917 | Critical | 9.8 | 2019-07-25 | Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can… |
CVE-2019-4236 | Medium | 4.4 | 2019-07-22 | A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from back… |
CVE-2019-13624 | Critical | 9.8 | 2019-07-17 | In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a… |
CVE-2019-1083 | High | 7.5 | 2019-07-15 | A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of Service Vulnerabilit… |
CVE-2019-0811 | High | 7.5 | 2019-07-15 | A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service Vulnerab… |
CVE-2019-12828 | High | 8.8 | 2019-06-14 | An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to i… |
CVE-2019-0941 | Medium | 4.4 | 2019-06-12 | A denial of service exists in Microsoft IIS Server when the optional request filtering feature improperly handles requests. An attacker who successfully exploi… |
CVE-2019-9673 | High | 8.8 | 2019-06-05 | Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI. |
CVE-2019-0089 | Medium | 6.7 | 2019-05-17 | Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, a… |
CVE-2019-0982 | High | 7.5 | 2019-05-16 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. |
CVE-2019-0981 | High | 7.5 | 2019-05-16 | A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service V… |
CVE-2019-0980 | High | 7.5 | 2019-05-16 | A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service V… |
CVE-2019-0947 | High | 7.8 | 2019-05-16 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0946 | High | 7.8 | 2019-05-16 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0945 | High | 7.8 | 2019-05-16 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-11070 | Medium | 5.3 | 2019-04-10 | WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smoot… |
CVE-2006-7254 | Medium | 5.5 | 2019-04-10 | The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local… |
CVE-2019-0817 | Medium | 5.4 | 2019-04-09 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoof… |
CVE-2019-0815 | High | 7.5 | 2019-04-09 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. |
CVE-2019-0801 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an attacker would have… |
CVE-2018-4329 | High | 7.5 | 2019-04-03 | Clearing a history item may not clear visits with redirect chains. The issue was addressed with improved data deletion. This issue affected versions prior to i… |
CVE-2019-10477 | High | 7.5 | 2019-03-29 | The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions. |
CVE-2019-9870 | Critical | 9.8 | 2019-03-21 | plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements. |
CVE-2019-0633 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB R… |
CVE-2019-0630 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB R… |
CVE-2019-9573 | High | 7.5 | 2019-03-05 | The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications. |
CVE-2019-9563 | High | 7.5 | 2019-03-04 | In BlueMind 3.5.x before 3.5.11 Hotfix 7 and 4.x before 4.0-beta3, the contact application mishandles temporary uploads. |
CVE-2009-5155 | High | 7.5 | 2019-02-26 | In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of ser… |
CVE-2018-5915 | Critical | 9.8 | 2019-01-18 | Exception in Modem IP stack while processing IPv6 packet in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9640, MDM9650… |
CVE-2019-6440 | Critical | 9.8 | 2019-01-16 | Zemana AntiMalware before 3.0.658 Beta mishandles update logic. |
CVE-2019-3554 | Medium | 5.9 | 2019-01-15 | Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems a… |
CVE-2019-0014 | High | 7.5 | 2019-01-15 | On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to… |
CVE-2019-0013 | Medium | 6.5 | 2019-01-15 | The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, re… |
CVE-2018-6133 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6106 | High | 8.8 | 2019-01-09 | An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object… |
CVE-2018-6100 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoof… |
CVE-2018-6097 | Medium | 6.5 | 2019-01-09 | Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen withou… |
CVE-2018-6091 | Medium | 6.5 | 2019-01-09 | Service Workers can intercept any request made by an <embed> or <object> tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to… |
CVE-2019-0564 | High | 7.5 | 2019-01-08 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects AS… |
CVE-2019-0548 | High | 7.5 | 2019-01-08 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects AS… |
CVE-2018-6332 | Medium | 5.9 | 2018-12-03 | A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This aff… |
CVE-2018-0485 | High | 8.6 | 2018-10-05 | A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4… |
CVE-2018-0455 | High | 7.5 | 2018-10-05 | A vulnerability in the Server Message Block Version 2 (SMBv2) and Version 3 (SMBv3) protocol implementation for the Cisco Firepower System Software could allow… |
CVE-2017-6920 | Critical | 9.8 | 2018-08-06 | Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certai… |
CVE-2016-1000340 | High | 7.5 | 2018-06-04 | In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes… |
CVE-2016-10455 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2016-10429 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055… |
CVE-2015-9166 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM960… |
CVE-2015-9137 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2014-10039 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, SD 400, and SD 800, calling qsee_app_entry_return() without… |
CVE-2018-0177 | High | 7.5 | 2018-03-28 | A vulnerability in the IP Version 4 (IPv4) processing code of Cisco IOS XE Software running on Cisco Catalyst 3850 and Cisco Catalyst 3650 Series Switches coul… |
CVE-2018-0157 | High | 8.6 | 2018-03-28 | A vulnerability in the Zone-Based Firewall code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a device to reload. The vulne… |
CVE-2018-0203 | Medium | 5.3 | 2018-02-22 | A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Rela… |
CVE-2015-0203 | Medium | 6.5 | 2018-02-21 | The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an… |
CVE-2015-0224 | High | 7.5 | 2017-10-30 | qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vuln… |
CVE-2012-5358 | Critical | 9.8 | 2017-10-30 | The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which… |
CVE-2012-5357 | Critical | 9.8 | 2017-10-30 | Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to exec… |
CVE-2006-5331 | Medium | 5.5 | 2017-10-29 | The altivec_unavailable_exception function in arch/powerpc/kernel/traps.c in the Linux kernel before 2.6.19 on 64-bit systems mishandles the case where CONFIG_… |
CVE-2016-4925 | High | 7.5 | 2017-10-13 | Receipt of a specifically malformed IPv6 packet processed by the router may trigger a line card reset: processor exception 0x68616c74 (halt) in task: scheduler… |
CVE-2014-0997 | High | 7.5 | 2017-09-26 | WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as… |
CVE-2015-0689 | High | 7.5 | 2017-09-19 | Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP meth… |
CVE-2015-3991 | Critical | 9.8 | 2017-09-07 | strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code. |
CVE-2016-3091 | High | 7.5 | 2017-06-08 | Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service. |
CVE-2015-2255 | Medium | 5.9 | 2017-06-08 | Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amoun… |
CVE-2016-4977 | High | 8.8 | 2017-05-25 | When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value… |
CVE-2016-0761 | Critical | 9.8 | 2017-05-25 | Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw in managing container files during Docke… |
CVE-2016-7540 | Medium | 6.5 | 2017-04-20 | coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image to rgf format. |
CVE-2015-1839 | Medium | 5.3 | 2017-04-13 | modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. |
CVE-2015-1838 | Medium | 5.3 | 2017-04-13 | modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. |
CVE-2014-9693 | Critical | 9.8 | 2017-04-02 | Huawei Tecal RH1288 V2 V100R002C00SPC107 and earlier versions, Tecal RH2265 V2 V100R002C00, Tecal RH2285 V2 V100R002C00SPC115 and earlier versions, Tecal RH226… |
CVE-2014-3223 | High | 7.5 | 2017-04-02 | Huawei S9300 with software before V100R006SPH013 and S2300,S3300,S5300,S6300 with software before V100R006SPH010 support Y.1731 and therefore have the Y.1731 v… |
CVE-2016-9252 | High | 7.5 | 2017-03-27 | The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path… |
CVE-2015-8985 | Medium | 5.9 | 2017-03-20 | The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and ap… |
CVE-2016-3013 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user to crash the MQ channel due to improper data conversion handling. IBM Reference #: 1998661. |
CVE-2016-7987 | High | 7.5 | 2017-02-13 | An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module for: SICAM AK, SICAM TM 1703, SICAM BC 170… |
CVE-2015-7979 | High | 7.5 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast pack… |
CVE-2016-8226 | Medium | 4.9 | 2017-01-26 | The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure. |
CVE-2016-9305 | Critical | 9.8 | 2017-01-25 | Improper handling in the Autodesk FBX-SDK before 2017.1 of type mismatches and previously deleted objects related to reading and converting malformed FBX forma… |
CVE-2016-2783 | Critical | 9.8 | 2017-01-23 | Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properly handle VLAN and I… |
CVE-2016-9650 | Medium | 4.3 | 2017-01-19 | Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attac… |
CVE-2016-5225 | Medium | 4.3 | 2017-01-19 | Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote… |
CVE-2016-5214 | Medium | 4.3 | 2017-01-19 | Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the… |
CVE-2016-6766 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in libmedia and libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang… |
CVE-2016-6765 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. T… |
CVE-2016-6287 | High | 7.5 | 2017-01-10 | The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even when running as a CGI… |
CVE-2016-6286 | High | 7.5 | 2017-01-10 | The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which would allow attackers to direct CGI prog… |
CVE-2016-1549 | Medium | 6.5 | 2017-01-06 | A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earl… |
CVE-2016-1548 | High | 7.2 | 2017-01-06 | An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After maki… |
CVE-2016-10081 | High | 7.8 | 2016-12-29 | /usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled duri… |
CVE-2015-0854 | High | 7.8 | 2016-12-29 | App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandle… |
CVE-2016-7292 | High | 7.8 | 2016-12-20 | The Installer in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1… |