CVE-2024-13784 | Critical | 9.8 | 2026-08-16 | The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… |
CVE-2024-58374 | High | 7.5 | 2026-08-13 | Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to acce… |
CVE-2024-27253 | Critical | 10.0 | 2026-08-12 | IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities. |
CVE-2024-14044 | Medium | 6.3 | 2026-08-12 | A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diam… |
CVE-2024-14043 | Medium | 6.3 | 2026-08-12 | A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-pa… |
CVE-2024-14042 | Medium | 6.3 | 2026-08-11 | A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c… |
CVE-2024-6541 | Medium | 6.8 | 2026-08-06 | The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated… |
CVE-2024-39024 | High | 8.8 | 2026-08-06 | In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. |
CVE-2024-8995 | Medium | 4.9 | 2026-08-06 | Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these code… |
CVE-2024-6832 | Medium | 5.9 | 2026-08-06 | The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locki… |
CVE-2024-10302 | Medium | 4.0 | 2026-08-06 | The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be inc… |
CVE-2024-40683 | Medium | 6.3 | 2026-07-30 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3… |
CVE-2024-25039 | High | 7.5 | 2026-07-30 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connecti… |
CVE-2024-14041 | | | 2026-07-28 | In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Pol… |
CVE-2024-14040 | High | 7.8 | 2026-07-26 | In the Linux kernel, the following vulnerability has been resolved:
net: nexthop: Increase weight to u16
In CLOS networks, as link failures occur at various… |
CVE-2024-58355 | High | 8.9 | 2026-07-23 | Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/bookin… |
CVE-2024-58354 | Critical | 9.9 | 2026-07-23 | cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses… |
CVE-2024-58353 | High | 8.9 | 2026-07-23 | Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /bo… |
CVE-2024-58330 | High | 7.5 | 2026-07-23 | A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data. |
CVE-2024-58023 | High | 8.4 | 2026-07-23 | Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. |
CVE-2024-5300 | Medium | 5.6 | 2026-07-21 | An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstractio… |
CVE-2024-51316 | High | 7.5 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName |
CVE-2024-51315 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName |
CVE-2024-51314 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg. |
CVE-2024-51312 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg. |
CVE-2024-51313 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg. |
CVE-2024-51311 | Critical | 9.8 | 2026-07-20 | The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList. |
CVE-2024-58370 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idio… |
CVE-2024-58369 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Auth… |
CVE-2024-58368 | High | 7.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated atta… |
CVE-2024-58367 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access un… |
CVE-2024-58366 | High | 8.5 | 2026-07-18 | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scriptin… |
CVE-2024-58365 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Auth… |
CVE-2024-58364 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator char… |
CVE-2024-58363 | Medium | 6.3 | 2026-07-18 | SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an aut… |
CVE-2024-58362 | High | 8.8 | 2026-07-18 | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively… |
CVE-2024-58361 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authoriz… |
CVE-2024-58359 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can ex… |
CVE-2024-58358 | Medium | 4.9 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexisten… |
CVE-2024-58357 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result fro… |
CVE-2024-58356 | Medium | 6.3 | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. B… |
CVE-2024-42214 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are… |
CVE-2024-23578 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows acc… |
CVE-2024-23577 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol… |
CVE-2024-23575 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An… |
CVE-2024-23574 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in… |
CVE-2024-23573 | Low | 3.7 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and… |
CVE-2024-23572 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should re… |
CVE-2024-23571 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its f… |
CVE-2024-23570 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in… |
CVE-2024-23569 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header |
CVE-2024-23568 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version inform… |
CVE-2024-23567 | Medium | 4.3 | 2026-07-17 | HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during norma… |
CVE-2024-23566 | Medium | 6.5 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute… |
CVE-2024-23565 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The a… |
CVE-2024-23564 | Critical | 9.1 | 2026-07-17 | HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redire… |
CVE-2024-34268 | High | 7.1 | 2026-07-16 | EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections. This v… |
CVE-2024-32389 | Low | 3.5 | 2026-07-16 | Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via… |
CVE-2024-32387 | Medium | 5.7 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string… |
CVE-2024-32386 | High | 7.3 | 2026-07-16 | Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information… |
CVE-2024-32385 | Medium | 4.3 | 2026-07-16 | An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via a boardID and revisio… |
CVE-2024-58360 | Medium | 6.5 | 2026-07-16 | stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification… |
CVE-2024-7708 | High | 7.5 | 2026-07-14 | For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.
This is particularly the case for 100-Continue, but… |
CVE-2024-56141 | Medium | 5.0 | 2026-07-07 | Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the Cry… |
CVE-2024-6228 | High | 7.5 | 2026-07-06 | The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file… |
CVE-2024-1248 | Medium | 4.8 | 2026-07-04 | The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation w… |
CVE-2024-58352 | High | 7.5 | 2026-07-02 | Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecti… |
CVE-2024-14037 | Critical | 9.8 | 2026-07-02 | Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious… |
CVE-2024-23581 | Medium | 6.7 | 2026-06-26 | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. |
CVE-2024-51454 | Medium | 6.5 | 2026-06-22 | IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable… |
CVE-2024-54178 | Medium | 6.5 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of servi… |
CVE-2024-58351 | Critical | 9.8 | 2026-06-20 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web… |
CVE-2024-27928 | | | 2026-06-17 | vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, t… |
CVE-2024-24769 | | | 2026-06-17 | vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API routes that send the… |
CVE-2024-47477 | Medium | 6.5 | 2026-06-17 | Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentiall… |
CVE-2024-52488 | Critical | 9.9 | 2026-06-17 | Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions. |
CVE-2024-49269 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions. |
CVE-2024-37496 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects… |
CVE-2024-37210 | Medium | 6.5 | 2026-06-17 | Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects AliNext: fr… |
CVE-2024-35690 | Medium | 6.5 | 2026-06-17 | Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data.
This issue affects Wi… |
CVE-2024-35648 | Medium | 4.3 | 2026-06-17 | Cross-Site request forgery (CSRF) vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery.
This issue affects Emergency Passwor… |
CVE-2024-34810 | Medium | 4.3 | 2026-06-17 | Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery.
This issue affects Skyline WP: from n/a through… |
CVE-2024-33909 | Medium | 5.3 | 2026-06-17 | Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects iPa… |
CVE-2024-33685 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Jegstudio Startupzy startupzy allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affec… |
CVE-2024-32949 | High | 8.3 | 2026-06-17 | Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affec… |
CVE-2024-32729 | High | 7.5 | 2026-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Trave… |
CVE-2024-31435 | Medium | 4.3 | 2026-06-17 | : Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue… |
CVE-2024-24709 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Shareaholic: fr… |
CVE-2024-39575 | High | 7.4 | 2026-06-16 | update_disk_psu_baseline.sh requires password in plain text |
CVE-2024-38487 | High | 7.0 | 2026-06-16 | api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions. |
CVE-2024-30476 | Medium | 5.4 | 2026-06-16 | PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentia… |
CVE-2024-24909 | High | 8.8 | 2026-06-16 | Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. A remote authenticated us… |
CVE-2024-22451 | Medium | 6.7 | 2026-06-16 | Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vu… |
CVE-2024-22447 | Medium | 6.7 | 2026-06-16 | Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnera… |
CVE-2024-45636 | Medium | 4.1 | 2026-06-11 | IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user. |
CVE-2024-32110 | Medium | 4.3 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery.
This issue affects WpEvently: from n/a through… |
CVE-2024-21944 | Medium | 5.3 | 2026-06-10 | Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-comp… |
CVE-2024-58350 | Low | 2.9 | 2026-06-10 | Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::tra… |
CVE-2024-58349 | Critical | 9.8 | 2026-06-08 | WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting… |
CVE-2024-58348 | Critical | 9.8 | 2026-06-08 | WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files b… |