CVE-2024-31027 | | | 2026-09-29 | Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the… |
CVE-2024-31026 | | | 2026-09-29 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the c… |
CVE-2024-58386 | Medium | 6.5 | 2026-09-28 | ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The… |
CVE-2024-42002 | High | 8.4 | 2026-09-28 | A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions fro… |
CVE-2024-56344 | Medium | 5.9 | 2026-09-18 | IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the fail… |
CVE-2024-38639 | Medium | 4.8 | 2026-09-18 | An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the securit… |
CVE-2024-27123 | | | 2026-09-18 | A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mec… |
CVE-2024-11222 | Medium | 6.4 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2024-58385 | Critical | 9.8 | 2026-09-15 | Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 paramete… |
CVE-2024-58384 | Medium | 5.4 | 2026-09-15 | Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request he… |
CVE-2024-14029 | High | 7.5 | 2026-09-15 | Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subseq… |
CVE-2024-58383 | High | 7.3 | 2026-09-14 | Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/… |
CVE-2024-23176 | Medium | 5.4 | 2026-09-14 | An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-pag… |
CVE-2024-53922 | Medium | 5.7 | 2026-09-14 | An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial… |
CVE-2024-12145 | Medium | 4.3 | 2026-09-11 | The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_act… |
CVE-2024-58382 | High | 7.5 | 2026-09-09 | league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service… |
CVE-2024-58381 | High | 7.5 | 2026-09-09 | PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sendi… |
CVE-2024-58380 | Medium | 6.5 | 2026-09-09 | PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slo… |
CVE-2024-11080 | Critical | 9.8 | 2026-09-05 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several f… |
CVE-2024-7956 | | | 2026-09-02 | A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor mu… |
CVE-2024-3773 | Medium | 5.9 | 2026-09-02 | The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2024-35585 | High | 8.6 | 2026-09-02 | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. |
CVE-2024-7953 | | | 2026-09-01 | A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat acto… |
CVE-2024-7952 | | | 2026-09-01 | A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without… |
CVE-2024-14047 | High | 7.2 | 2026-09-01 | A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged att… |
CVE-2024-10085 | | | 2026-09-01 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when… |
CVE-2024-58379 | Medium | 5.3 | 2026-08-31 | nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embed… |
CVE-2024-13942 | High | 7.6 | 2026-08-19 | Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD).
… |
CVE-2024-58376 | Medium | 6.7 | 2026-08-19 | Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers wit… |
CVE-2024-14046 | Medium | 6.3 | 2026-08-18 | A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/… |
CVE-2024-14045 | Medium | 6.3 | 2026-08-18 | A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInter… |
CVE-2024-58375 | High | 7.5 | 2026-08-16 | OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, v… |
CVE-2024-13784 | Critical | 9.8 | 2026-08-16 | The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… |
CVE-2024-58374 | High | 7.5 | 2026-08-13 | Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to acce… |
CVE-2024-27253 | Critical | 10.0 | 2026-08-12 | IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities. |
CVE-2024-14044 | Medium | 6.3 | 2026-08-12 | A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diam… |
CVE-2024-14043 | Medium | 6.3 | 2026-08-12 | A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-pa… |
CVE-2024-14042 | Medium | 6.3 | 2026-08-11 | A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c… |
CVE-2024-6541 | Medium | 6.8 | 2026-08-06 | The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated… |
CVE-2024-39024 | High | 8.8 | 2026-08-06 | In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. |
CVE-2024-8995 | Medium | 4.9 | 2026-08-06 | Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these code… |
CVE-2024-6832 | Medium | 5.9 | 2026-08-06 | The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locki… |
CVE-2024-10302 | Medium | 4.0 | 2026-08-06 | The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be inc… |
CVE-2024-40683 | Medium | 6.3 | 2026-07-30 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3… |
CVE-2024-25039 | High | 7.5 | 2026-07-30 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connecti… |
CVE-2024-14041 | Medium | 5.9 | 2026-07-28 | In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Pol… |
CVE-2024-14040 | High | 7.8 | 2026-07-26 | In the Linux kernel, the following vulnerability has been resolved:
net: nexthop: Increase weight to u16
In CLOS networks, as link failures occur at various… |
CVE-2024-58355 | High | 8.9 | 2026-07-23 | Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/bookin… |
CVE-2024-58354 | Critical | 9.9 | 2026-07-23 | cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses… |
CVE-2024-58353 | High | 8.9 | 2026-07-23 | Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /bo… |
CVE-2024-58330 | High | 7.5 | 2026-07-23 | A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data. |
CVE-2024-58023 | High | 8.4 | 2026-07-23 | Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. |
CVE-2024-5300 | Medium | 5.6 | 2026-07-21 | An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstractio… |
CVE-2024-51316 | High | 7.5 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName |
CVE-2024-51315 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName |
CVE-2024-51314 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg. |
CVE-2024-51312 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg. |
CVE-2024-51313 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg. |
CVE-2024-51311 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList. |
CVE-2024-58370 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idio… |
CVE-2024-58369 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Auth… |
CVE-2024-58368 | High | 7.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated atta… |
CVE-2024-58367 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access un… |
CVE-2024-58366 | High | 8.5 | 2026-07-18 | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scriptin… |
CVE-2024-58365 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Auth… |
CVE-2024-58364 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator char… |
CVE-2024-58363 | Medium | 6.3 | 2026-07-18 | SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an aut… |
CVE-2024-58362 | High | 8.8 | 2026-07-18 | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively… |
CVE-2024-58361 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authoriz… |
CVE-2024-58359 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can ex… |
CVE-2024-58358 | Medium | 4.9 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexisten… |
CVE-2024-58357 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result fro… |
CVE-2024-58356 | Medium | 6.3 | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. B… |
CVE-2024-42214 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are… |
CVE-2024-23578 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows acc… |
CVE-2024-23577 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol… |
CVE-2024-23575 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An… |
CVE-2024-23574 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in… |
CVE-2024-23573 | Low | 3.7 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and… |
CVE-2024-23572 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should re… |
CVE-2024-23571 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its f… |
CVE-2024-23570 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in… |
CVE-2024-23569 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header |
CVE-2024-23568 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version inform… |
CVE-2024-23567 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during norma… |
CVE-2024-23566 | Medium | 6.5 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute… |
CVE-2024-23565 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The a… |
CVE-2024-23564 | Critical | 9.1 | 2026-07-17 | HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redire… |
CVE-2024-34268 | High | 7.1 | 2026-07-16 | EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections. This v… |
CVE-2024-32389 | Low | 3.5 | 2026-07-16 | Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via… |
CVE-2024-32387 | Medium | 5.7 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string… |
CVE-2024-32386 | High | 7.3 | 2026-07-16 | Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information… |
CVE-2024-32385 | Medium | 4.3 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via a boardID and revisio… |
CVE-2024-58360 | Medium | 6.5 | 2026-07-16 | stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification… |
CVE-2024-7708 | High | 7.5 | 2026-07-14 | For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.
This is particularly the case for 100-Continue, but… |
CVE-2024-56141 | Medium | 5.0 | 2026-07-07 | Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the Cry… |
CVE-2024-6228 | High | 7.5 | 2026-07-06 | The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file… |
CVE-2024-1248 | Medium | 4.8 | 2026-07-04 | The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation w… |
CVE-2024-58352 | High | 7.5 | 2026-07-02 | Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecti… |
CVE-2024-14037 | Critical | 9.8 | 2026-07-02 | Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious… |