CVE-2026-68562 | Medium | 6.2 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When… |
CVE-2026-55390 | High | 7.5 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/par… |
CVE-2026-55389 | High | 7.5 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw J… |
CVE-2026-15583 | High | 8.6 | 2026-07-15 | A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-accoun… |
CVE-2026-12879 | | | 2026-07-09 | An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated… |
CVE-2026-10816 | High | 7.5 | 2026-06-30 | Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is ena… |
CVE-2026-57301 | High | 8.8 | 2026-06-24 | Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Con… |
CVE-2026-12788 | Medium | 6.3 | 2026-06-21 | A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /… |
CVE-2026-47643 | Critical | 9.8 | 2026-06-09 | External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network. |
CVE-2026-0418 | Medium | 4.5 | 2026-06-09 | Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network
to tamper with the system. |
CVE-2026-45760 | High | 8.1 | 2026-05-21 | (Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authoriz… |
CVE-2026-47358 | High | 7.5 | 2026-05-19 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server m… |
CVE-2026-47357 | High | 7.5 | 2026-05-19 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{… |
CVE-2026-30905 | High | 7.8 | 2026-05-13 | External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to con… |
CVE-2026-41107 | High | 7.4 | 2026-05-12 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-40370 | High | 8.8 | 2026-05-12 | External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-32204 | High | 7.8 | 2026-05-12 | External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-34327 | High | 8.2 | 2026-05-07 | Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-30817 | Medium | 5.7 | 2026-04-08 | An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files wh… |
CVE-2026-30816 | Medium | 5.7 | 2026-04-08 | An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file… |
CVE-2026-0522 | High | 8.8 | 2026-04-01 | A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the… |
CVE-2026-32008 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authe… |
CVE-2026-30903 | Critical | 9.6 | 2026-03-11 | External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation… |
CVE-2026-28722 | High | 7.3 | 2026-03-06 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28721 | High | 7.3 | 2026-03-06 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2025-48654 | High | 7.8 | 2026-03-02 | In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of… |
CVE-2026-3404 | Medium | 5.0 | 2026-03-02 | A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the com… |
CVE-2026-2536 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow… |
CVE-2026-2074 | Medium | 6.3 | 2026-02-07 | A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP P… |
CVE-2026-1218 | Medium | 6.3 | 2026-01-20 | A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.arte… |
CVE-2025-15251 | Medium | 5.6 | 2025-12-30 | A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/jav… |
CVE-2025-68478 | High | 7.1 | 2025-12-19 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's… |
CVE-2025-48598 | Medium | 6.6 | 2025-12-08 | In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalatio… |
CVE-2025-13209 | Medium | 6.3 | 2025-11-15 | A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\jav… |
CVE-2025-11341 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=S… |
CVE-2025-11140 | High | 7.3 | 2025-09-29 | A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient… |
CVE-2025-11035 | Medium | 6.3 | 2025-09-26 | A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=Ge… |
CVE-2025-10816 | High | 7.3 | 2025-09-22 | A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&… |
CVE-2025-8057 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Pati… |
CVE-2025-9065 | High | 8.8 | 2025-09-09 | A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attac… |
CVE-2025-10092 | High | 7.3 | 2025-09-08 | A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add o… |
CVE-2025-10091 | High | 7.3 | 2025-09-08 | A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Ty… |
CVE-2024-49728 | Medium | 5.5 | 2025-09-02 | In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local inform… |
CVE-2024-49722 | Medium | 5.5 | 2025-09-02 | In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information d… |
CVE-2025-48963 | High | 7.3 | 2025-08-28 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2025-26417 | Medium | 4.0 | 2025-08-26 | In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused… |
CVE-2025-0082 | Medium | 5.5 | 2025-08-26 | In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy. This coul… |
CVE-2015-10142 | | | 2025-07-25 | Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior… |
CVE-2025-7824 | High | 7.3 | 2025-07-19 | A vulnerability was found in Jinher OA 1.1. It has been rated as problematic. This issue affects some unknown processing of the file XmlHttp.aspx. The manipula… |
CVE-2025-7823 | High | 7.3 | 2025-07-19 | A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx… |
CVE-2025-7523 | High | 7.3 | 2025-07-13 | A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.messa… |
CVE-2025-6691 | High | 8.1 | 2025-07-09 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-5877 | Medium | 6.3 | 2025-06-09 | A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of… |
CVE-2025-2875 | High | 7.5 | 2025-05-14 | CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could
cause a loss of confidentiality when an unauthenticate… |
CVE-2025-26684 | Medium | 6.7 | 2025-05-13 | External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2024-13177 | | | 2025-04-15 | Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A st… |
CVE-2025-3241 | Medium | 6.3 | 2025-04-04 | A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/c… |
CVE-2025-2365 | Medium | 6.3 | 2025-03-17 | A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeCh… |
CVE-2024-51961 | High | 7.5 | 2025-03-03 | There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could poten… |
CVE-2025-0111 | Medium | 6.5 | 2025-02-12 | An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… |
CVE-2025-1225 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/m… |
CVE-2022-23439 | Medium | 4.7 | 2025-01-22 | A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, wh… |
CVE-2025-22144 | Critical | 9.8 | 2025-01-13 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can vali… |
CVE-2024-42168 | High | 8.9 | 2025-01-11 | HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then ind… |
CVE-2024-52792 | Medium | 6.5 | 2024-12-17 | LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM… |
CVE-2024-10979 | High | 8.8 | 2024-11-14 | Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. P… |
CVE-2024-5823 | Critical | 9.1 | 2024-10-29 | A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to… |
CVE-2024-47773 | High | 8.2 | 2024-10-08 | Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without an… |
CVE-2024-45826 | Medium | 6.8 | 2024-09-12 | CVE-2024-45826 IMPACT
Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a craft… |
CVE-2024-8207 | Medium | 6.4 | 2024-08-27 | In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a uninte… |
CVE-2024-7911 | Medium | 6.3 | 2024-08-18 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /sim… |
CVE-2024-7625 | Medium | 5.8 | 2024-08-15 | In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocatio… |
CVE-2024-6079 | | | 2024-08-13 | A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application loads shared librarie… |
CVE-2024-28962 | Medium | 6.5 | 2024-08-06 | Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthen… |
CVE-2024-29069 | Medium | 4.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the
destination of symbolic links when extracting a snap. The snap format
is a squashfs file-s… |
CVE-2024-6717 | High | 7.7 | 2024-07-23 | HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation director… |
CVE-2024-31319 | High | 7.8 | 2024-07-09 | In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This… |
CVE-2024-38049 | Medium | 6.6 | 2024-07-09 | Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability |
CVE-2024-28826 | High | 8.8 | 2024-05-29 | Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attacker… |
CVE-2024-32980 | Critical | 9.1 | 2024-05-08 | Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applicati… |
CVE-2023-6154 | High | 7.8 | 2024-04-01 | A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender An… |
CVE-2024-24818 | Medium | 5.9 | 2024-03-21 | EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victi… |
CVE-2024-25117 | Medium | 6.8 | 2024-02-21 | php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't… |
CVE-2024-23639 | Medium | 5.1 | 2024-02-09 | Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Ko… |
CVE-2024-1329 | High | 7.7 | 2024-02-08 | HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user… |
CVE-2024-24760 | High | 8.8 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affectin… |
CVE-2020-36772 | Medium | 4.4 | 2024-01-22 | CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitr… |
CVE-2024-0728 | Medium | 4.7 | 2024-01-19 | A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channe… |
CVE-2023-49864 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49863 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49862 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-6569 | High | 8.2 | 2023-12-14 | External Control of File Name or Path in h2oai/h2o-3 |
CVE-2023-6618 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2023-5247 | High | 7.8 | 2023-11-30 | Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a m… |
CVE-2023-40194 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace character… |
CVE-2023-39542 | High | 8.8 | 2023-11-27 | A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files… |
CVE-2023-35985 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dan… |
CVE-2023-34982 | Medium | 5.5 | 2023-11-15 |
This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on… |
CVE-2023-40139 | Medium | 5.5 | 2023-10-27 | In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with… |
CVE-2023-4089 | Low | 2.7 | 2023-10-17 | On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local fi… |