Export limit exceeded: 369398 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369398 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-40812 | 1 Siemens | 2 Solid Edge Se2024, Solid Edge Se2025 | 2025-10-21 | 7.8 High |
| A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process. | ||||
| CVE-2025-40810 | 1 Siemens | 2 Solid Edge Se2024, Solid Edge Se2025 | 2025-10-21 | 7.8 High |
| A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process. | ||||
| CVE-2025-11736 | 2 Angeljudesuarez, Itsourcecode | 2 Online Examination System, Online Examination System | 2025-10-21 | 7.3 High |
| A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2025-54271 | 2 Adobe, Apple | 3 Creative Cloud, Creative Cloud Desktop Application, Macos | 2025-10-21 | 5.6 Medium |
| Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary file system write. A low-privileged attacker could exploit the timing between the check and use of a resource, potentially allowing unauthorized modifications to files. Exploitation of this issue does not require user interaction. | ||||
| CVE-2024-8008 | 1 Wso2 | 6 Api Manager, Enterprise Integrator, Identity Server and 3 more | 2025-10-21 | 5.2 Medium |
| A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible. | ||||
| CVE-2025-62684 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2025-62683 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2025-62682 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2025-62681 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2025-62680 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2025-62679 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2025-62678 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2025-62677 | 2025-10-21 | N/A | ||
| Not used | ||||
| CVE-2024-38593 | 2 Linux, Redhat | 2 Linux Kernel, Enterprise Linux | 2025-10-20 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: net: micrel: Fix receiving the timestamp in the frame for lan8841 The blamed commit started to use the ptp workqueue to get the second part of the timestamp. And when the port was set down, then this workqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING is not enabled, then the ptp_clock is not initialized so then it would crash when it would try to access the delayed work. So then basically by setting up and then down the port, it would crash. The fix consists in checking if the ptp_clock is initialized and only then cancel the delayed work. | ||||
| CVE-2024-38564 | 2 Linux, Redhat | 6 Linux Kernel, Enterprise Linux, Rhel Aus and 3 more | 2025-10-20 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses bpf_prog_get and relies on bpf_prog_attach_check_attach_type to properly verify prog_type <> attach_type association. Add missing attach_type enforcement for the link_create case. Otherwise, it's currently possible to attach cgroup_skb prog types to other cgroup hooks. | ||||
| CVE-2025-2934 | 1 Gitlab | 1 Gitlab | 2025-10-20 | 4.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses. | ||||
| CVE-2025-11340 | 1 Gitlab | 1 Gitlab | 2025-10-20 | 7.7 High |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations. | ||||
| CVE-2025-10004 | 1 Gitlab | 1 Gitlab | 2025-10-20 | 7.5 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs. | ||||
| CVE-2025-11551 | 2 Carmelo, Code-projects | 2 Student Result Manager, Student Result Manager | 2025-10-20 | 6.3 Medium |
| A vulnerability was determined in code-projects Student Result Manager 1.0. This affects an unknown function of the file src/students/Database.java. This manipulation of the argument roll/name/gpa causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2025-11553 | 2 Carmelogarcia, Code-projects | 2 Courier Management System, Courier Management System | 2025-10-20 | 6.3 Medium |
| A weakness has been identified in code-projects Courier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-courier.php. Executing manipulation of the argument Shippername can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. | ||||