CVE-2023-54400 | Critical | 9.8 | 2026-09-29 | Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary S… |
CVE-2023-54399 | Critical | 9.8 | 2026-09-18 | Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a databa… |
CVE-2023-5778 | High | 7.5 | 2026-09-18 | Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC8… |
CVE-2023-54398 | Critical | 9.8 | 2026-09-15 | Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote una… |
CVE-2023-54397 | High | 7.5 | 2026-09-15 | Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Atta… |
CVE-2023-51769 | Medium | 6.1 | 2026-09-14 | Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages. |
CVE-2023-50462 | Medium | 5.3 | 2026-09-14 | An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element… |
CVE-2023-50461 | High | 8.8 | 2026-09-14 | An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an aut… |
CVE-2023-50460 | Medium | 5.4 | 2026-09-14 | An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actio… |
CVE-2023-50459 | Medium | 5.4 | 2026-09-14 | An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticat… |
CVE-2023-46273 | High | 8.8 | 2026-09-14 | Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send. |
CVE-2023-46035 | Medium | 5.9 | 2026-09-14 | The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. |
CVE-2023-45858 | High | 8.6 | 2026-09-14 | A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files. |
CVE-2023-45023 | Medium | 4.2 | 2026-09-14 | The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component. |
CVE-2023-40772 | Medium | 4.3 | 2026-09-14 | A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticRe… |
CVE-2023-37366 | Low | 2.8 | 2026-09-14 | An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exyn… |
CVE-2023-37253 | Low | 3.1 | 2026-09-14 | An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variab… |
CVE-2023-37252 | Low | 3.1 | 2026-09-14 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden. |
CVE-2023-34854 | Medium | 6.6 | 2026-09-14 | HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. |
CVE-2023-32803 | High | 7.5 | 2026-09-14 | The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the r… |
CVE-2023-32778 | Low | 3.3 | 2026-09-14 | An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload. |
CVE-2023-29377 | Medium | 6.6 | 2026-09-14 | An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to… |
CVE-2023-28148 | High | 7.2 | 2026-09-14 | A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. |
CVE-2023-24291 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter. |
CVE-2023-24288 | Low | 2.9 | 2026-09-14 | An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessive amount of save sta… |
CVE-2023-24287 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command. |
CVE-2023-24286 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter. |
CVE-2023-24285 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed. |
CVE-2023-24284 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function. |
CVE-2023-24283 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2023-24035 | Low | 3.5 | 2026-09-14 | An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker bei… |
CVE-2023-24034 | Low | 3.1 | 2026-09-14 | An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect v… |
CVE-2023-22632 | Low | 2.7 | 2026-09-14 | PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor. |
CVE-2023-22631 | Low | 2.7 | 2026-09-14 | PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor. |
CVE-2023-54396 | Medium | 6.5 | 2026-09-09 | PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inv… |
CVE-2023-54395 | Medium | 4.3 | 2026-09-09 | PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server reso… |
CVE-2023-54394 | Medium | 4.3 | 2026-09-09 | PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory syn… |
CVE-2023-54393 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper depende… |
CVE-2023-54392 | Medium | 6.5 | 2026-09-09 | PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash… |
CVE-2023-54390 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arr… |
CVE-2023-54355 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers… |
CVE-2023-20577 | High | 7.4 | 2026-09-02 | A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary… |
CVE-2023-20576 | High | 7.7 | 2026-09-02 | Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege e… |
CVE-2023-3360 | Low | 3.3 | 2026-09-02 | The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high… |
CVE-2023-54391 | Critical | 9.8 | 2026-09-01 | Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthentica… |
CVE-2023-54356 | Low | 3.7 | 2026-09-01 | Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS end… |
CVE-2023-31308 | Low | 3.3 | 2026-08-31 | A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read. |
CVE-2023-20511 | Medium | 6.4 | 2026-08-31 | Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to ar… |
CVE-2023-42179 | Critical | 9.8 | 2026-08-26 | Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process. |
CVE-2023-37507 | High | 7.5 | 2026-07-21 | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. |
CVE-2023-37508 | Medium | 6.1 | 2026-07-21 | HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknes… |
CVE-2023-54366 | High | 8.8 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explici… |
CVE-2023-49900 | Critical | 9.8 | 2026-07-16 | An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command. |
CVE-2023-49899 | Critical | 9.8 | 2026-07-16 | An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel. |
CVE-2023-37524 | High | 7.7 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reach… |
CVE-2023-20572 | | | 2026-06-26 | An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, all… |
CVE-2023-20540 | | | 2026-06-26 | An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, all… |
CVE-2023-54365 | High | 7.5 | 2026-06-23 | Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP… |
CVE-2023-33854 | Medium | 5.3 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-s… |
CVE-2023-45796 | High | 8.1 | 2026-06-22 | A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-priv… |
CVE-2023-45795 | High | 7.8 | 2026-06-22 | A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascr… |
CVE-2023-54357 | High | 7.5 | 2026-06-19 | Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploit… |
CVE-2023-54353 | High | 7.8 | 2026-06-19 | Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placin… |
CVE-2023-32959 | Medium | 4.3 | 2026-06-11 | Missing Authorization vulnerability in Sparkle WP MetroStore metrostore allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue af… |
CVE-2023-25969 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2023-40200 | Medium | 5.3 | 2026-06-11 | Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectl… |
CVE-2023-33999 | High | 7.1 | 2026-06-11 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.
This issue aff… |
CVE-2023-43688 | High | 7.5 | 2026-06-09 | An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a Heap buffer overflow in various buffer encryption utilities. |
CVE-2023-43686 | Medium | 6.2 | 2026-06-09 | An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). A large number of Firefox preference files can cause the parser to ignor… |
CVE-2023-29146 | High | 8.2 | 2026-06-09 | The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. T… |
CVE-2023-54352 | Critical | 9.8 | 2026-06-08 | WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious fi… |
CVE-2023-54351 | High | 7.2 | 2026-06-08 | WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts throug… |
CVE-2023-54350 | High | 7.5 | 2026-06-08 | WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and… |
CVE-2023-5502 | Medium | 5.9 | 2026-06-04 | On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports… |
CVE-2023-52951 | Medium | 5.9 | 2026-06-03 | A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain u… |
CVE-2023-52945 | High | 7.8 | 2026-05-27 | Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbit… |
CVE-2023-7346 | Medium | 4.0 | 2026-05-20 | Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displa… |
CVE-2023-7345 | Medium | 6.5 | 2026-05-19 | Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-7… |
CVE-2023-24215 | Critical | 9.1 | 2026-05-18 | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials vi… |
CVE-2023-31317 | | | 2026-05-15 | Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or write to protected… |
CVE-2023-31316 | | | 2026-05-15 | Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could allow an attacker… |
CVE-2023-31309 | | | 2026-05-15 | Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data fr… |
CVE-2023-30059 | Medium | 5.4 | 2026-05-12 | An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado para… |
CVE-2023-27753 | High | 8.0 | 2026-05-12 | An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2023-46453 | Critical | 9.8 | 2026-05-08 | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid S… |
CVE-2023-47268 | Medium | 5.3 | 2026-05-08 | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is s… |
CVE-2023-42346 | High | 7.5 | 2026-05-08 | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host. |
CVE-2023-42345 | Medium | 6.1 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. |
CVE-2023-42344 | High | 7.3 | 2026-05-08 | Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet. |
CVE-2023-42343 | Medium | 6.1 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. |
CVE-2023-54349 | Medium | 6.1 | 2026-05-05 | AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloa… |
CVE-2023-54348 | High | 8.8 | 2026-05-05 | ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute o… |
CVE-2023-54347 | High | 7.5 | 2026-05-05 | OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts… |
CVE-2023-54346 | High | 7.5 | 2026-05-05 | WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database ba… |
CVE-2023-54345 | High | 8.8 | 2026-05-05 | Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute… |
CVE-2023-54344 | Critical | 9.8 | 2026-05-05 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by se… |
CVE-2023-54342 | Critical | 9.8 | 2026-05-05 | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to… |
CVE-2023-20585 | | | 2026-04-16 | Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds co… |
CVE-2023-5872 | Medium | 4.3 | 2026-04-16 | In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific… |
CVE-2023-3634 | High | 8.8 | 2026-04-16 | In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead… |