CVE-2023-37507 | High | 7.5 | 2026-07-21 | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. |
CVE-2023-37508 | Medium | 6.1 | 2026-07-21 | HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknes… |
CVE-2023-54366 | High | 8.8 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explici… |
CVE-2023-49900 | Critical | 9.8 | 2026-07-16 | An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command. |
CVE-2023-49899 | Critical | 9.8 | 2026-07-16 | An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel. |
CVE-2023-37524 | High | 7.7 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reach… |
CVE-2023-20572 | | | 2026-06-26 | An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, all… |
CVE-2023-20540 | | | 2026-06-26 | An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, all… |
CVE-2023-54365 | High | 7.5 | 2026-06-23 | Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP… |
CVE-2023-33854 | Medium | 5.3 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-s… |
CVE-2023-45796 | High | 8.1 | 2026-06-22 | A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-priv… |
CVE-2023-45795 | High | 7.8 | 2026-06-22 | A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascr… |
CVE-2023-54357 | High | 7.5 | 2026-06-19 | Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploit… |
CVE-2023-54353 | High | 7.8 | 2026-06-19 | Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placin… |
CVE-2023-32959 | Medium | 4.3 | 2026-06-11 | Missing Authorization vulnerability in Sparkle WP MetroStore metrostore allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue af… |
CVE-2023-25969 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2023-40200 | Medium | 5.3 | 2026-06-11 | Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectl… |
CVE-2023-33999 | High | 7.1 | 2026-06-11 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.
This issue aff… |
CVE-2023-43688 | High | 7.5 | 2026-06-09 | An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a Heap buffer overflow in various buffer encryption utilities. |
CVE-2023-43686 | Medium | 6.2 | 2026-06-09 | An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). A large number of Firefox preference files can cause the parser to ignor… |
CVE-2023-29146 | High | 8.2 | 2026-06-09 | The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. T… |
CVE-2023-54352 | Critical | 9.8 | 2026-06-08 | WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious fi… |
CVE-2023-54351 | High | 7.2 | 2026-06-08 | WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts throug… |
CVE-2023-54350 | High | 7.5 | 2026-06-08 | WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and… |
CVE-2023-5502 | Medium | 5.9 | 2026-06-04 | On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports… |
CVE-2023-52951 | Medium | 5.9 | 2026-06-03 | A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain u… |
CVE-2023-52945 | High | 7.8 | 2026-05-27 | Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbit… |
CVE-2023-7346 | Medium | 4.0 | 2026-05-20 | Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displa… |
CVE-2023-7345 | Medium | 6.5 | 2026-05-19 | Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-7… |
CVE-2023-24215 | Critical | 9.1 | 2026-05-18 | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials vi… |
CVE-2023-31317 | | | 2026-05-15 | Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or write to protected… |
CVE-2023-31316 | | | 2026-05-15 | Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could allow an attacker… |
CVE-2023-31309 | | | 2026-05-15 | Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data fr… |
CVE-2023-30059 | Medium | 5.4 | 2026-05-12 | An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado para… |
CVE-2023-27753 | High | 8.0 | 2026-05-12 | An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2023-46453 | Critical | 9.8 | 2026-05-08 | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid S… |
CVE-2023-47268 | Medium | 5.3 | 2026-05-08 | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is s… |
CVE-2023-42346 | High | 7.5 | 2026-05-08 | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host. |
CVE-2023-42345 | Medium | 6.1 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. |
CVE-2023-42344 | High | 7.3 | 2026-05-08 | Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet. |
CVE-2023-42343 | Medium | 6.1 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. |
CVE-2023-54349 | Medium | 6.1 | 2026-05-05 | AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloa… |
CVE-2023-54348 | High | 8.8 | 2026-05-05 | ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute o… |
CVE-2023-54347 | High | 7.5 | 2026-05-05 | OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts… |
CVE-2023-54346 | High | 7.5 | 2026-05-05 | WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database ba… |
CVE-2023-54345 | High | 8.8 | 2026-05-05 | Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute… |
CVE-2023-54344 | Critical | 9.8 | 2026-05-05 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by se… |
CVE-2023-54342 | Critical | 9.8 | 2026-05-05 | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to… |
CVE-2023-20585 | | | 2026-04-16 | Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds co… |
CVE-2023-5872 | Medium | 4.3 | 2026-04-16 | In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific… |
CVE-2023-3634 | High | 8.8 | 2026-04-16 | In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead… |
CVE-2023-54364 | Medium | 6.1 | 2026-04-09 | Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating… |
CVE-2023-54363 | Medium | 6.1 | 2026-04-09 | Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulatin… |
CVE-2023-54362 | Medium | 6.1 | 2026-04-09 | Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulatin… |
CVE-2023-54361 | Medium | 6.1 | 2026-04-09 | Joomla iProperty Real Estate 4.1.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating th… |
CVE-2023-54360 | Medium | 6.1 | 2026-04-09 | Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_i… |
CVE-2023-54359 | High | 8.2 | 2026-04-09 | WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie… |
CVE-2023-54358 | Medium | 6.1 | 2026-04-09 | WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts b… |
CVE-2023-46945 | Critical | 9.1 | 2026-04-08 | QD 20230821 is vulnerable to Server-side request forgery (SSRF) via a crafted request |
CVE-2023-7343 | High | 7.8 | 2026-04-02 | Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02 contain an arbitrary code execution vulnerability triggered when an administra… |
CVE-2023-7342 | High | 8.8 | 2026-04-02 | HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor rol… |
CVE-2023-7340 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2023-7339 | Medium | 6.5 | 2026-03-27 | Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers.
This issue affects
pnGate: through 1.30
epGat… |
CVE-2023-7338 | High | 7.5 | 2026-03-26 | Ruckus Unleashed contains a remote code execution vulnerability in the web-based management interface that allows authenticated remote attackers to execute arb… |
CVE-2023-40693 | Medium | 5.4 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, and 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1 are vulnerable to… |
CVE-2023-43010 | High | 8.8 | 2026-03-12 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS… |
CVE-2023-27573 | Critical | 9.0 | 2026-03-11 | netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567… |
CVE-2023-7337 | High | 7.5 | 2026-03-04 | The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie… |
CVE-2023-31044 | Low | 2.0 | 2026-03-03 | An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, ca… |
CVE-2023-31364 | | | 2026-02-26 | Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with wr… |
CVE-2023-38005 | Medium | 4.3 | 2026-02-17 | IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access con… |
CVE-2023-38265 | Medium | 5.3 | 2026-02-17 | IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose folder location information to an unauthenticated attacker that could aid i… |
CVE-2023-31323 | | | 2026-02-12 | Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Interconnect Trusted Agent… |
CVE-2023-20601 | | | 2026-02-12 | Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-of-service conditio… |
CVE-2023-31313 | High | 7.2 | 2026-02-12 | An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages to the system mana… |
CVE-2023-31324 | High | 7.8 | 2026-02-11 | A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Tru… |
CVE-2023-20548 | High | 7.8 | 2026-02-11 | A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity… |
CVE-2023-20514 | | | 2026-02-11 | Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trust… |
CVE-2023-38281 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a… |
CVE-2023-38017 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-38010 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system. |
CVE-2023-54343 | Medium | 6.4 | 2026-02-01 | QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path… |
CVE-2023-37525 | Medium | 5.3 | 2026-01-28 | A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class… |
CVE-2023-7335 | | | 2026-01-22 | EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the classroom-course-statistics export functionality. A remote, unauthenticate… |
CVE-2023-7334 | Critical | 9.8 | 2026-01-15 | Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A… |
CVE-2023-54341 | Medium | 6.1 | 2026-01-13 | Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file… |
CVE-2023-54340 | High | 8.2 | 2026-01-13 | WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password paramete… |
CVE-2023-54339 | Critical | 9.8 | 2026-01-13 | Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index… |
CVE-2023-54338 | High | 8.4 | 2026-01-13 | Tftpd32 SE 4.60 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Att… |
CVE-2023-54337 | Critical | 9.1 | 2026-01-13 | Sysax Multi Server 6.95 contains a denial of service vulnerability in the administrative password field that allows attackers to crash the application. Attacke… |
CVE-2023-54336 | High | 8.4 | 2026-01-13 | Mediconta 3.7.27 contains an unquoted service path vulnerability in the servermedicontservice that allows local users to potentially execute code with elevated… |
CVE-2023-54335 | Critical | 9.8 | 2026-01-13 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers… |
CVE-2023-54334 | Critical | 9.8 | 2026-01-13 | Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allows attackers to execute arbitrary code… |
CVE-2023-54333 | High | 8.2 | 2026-01-13 | Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. At… |
CVE-2023-54332 | Medium | 6.1 | 2026-01-13 | Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id par… |
CVE-2023-54331 | High | 7.8 | 2026-01-13 | Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges… |
CVE-2023-54330 | Critical | 9.8 | 2026-01-13 | Inbit Messenger versions 4.6.0 to 4.9.0 contain a remote stack-based buffer overflow vulnerability that allows unauthenticated attackers to execute arbitrary c… |
CVE-2023-54329 | Critical | 9.8 | 2026-01-13 | Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiti… |
CVE-2023-54328 | Medium | 6.5 | 2026-01-13 | AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate… |
CVE-2023-53985 | Medium | 6.1 | 2026-01-13 | Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through u… |