Export limit exceeded: 373612 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373612 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-54679 | 1 Cyberpanel | 1 Cyberpanel | 2025-09-05 | 4.3 Medium |
| CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. | ||||
| CVE-2024-32018 | 1 Riot-os | 1 Riot | 2025-09-05 | 8.8 High |
| RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. Most codebases define assertion macros which compile to a no-op on non-debug builds. If assertions are the only line of defense against untrusted input, the software may be exposed to attacks that leverage the lack of proper input checks. In detail, in the `nimble_scanlist_update()` function below, `len` is checked in an assertion and subsequently used in a call to `memcpy()`. If an attacker is able to provide a larger `len` value while assertions are compiled-out, they can write past the end of the fixed-length `e->ad` buffer. If the unchecked input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerability could range from denial of service to arbitrary code execution. This issue has not yet been patched. Users are advised to add manual `len` checking. | ||||
| CVE-2025-0287 | 1 Paragon-software | 6 Paragon Backup \& Recovery, Paragon Disk Wiper, Paragon Drive Copy and 3 more | 2025-09-05 | 5.1 Medium |
| Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation. | ||||
| CVE-2025-38603 | 1 Linux | 1 Linux Kernel | 2025-09-05 | 5.5 Medium |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2024-53376 | 1 Cyberpanel | 1 Cyberpanel | 2025-09-05 | 8.8 High |
| CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI. | ||||
| CVE-2024-56112 | 1 Cyberpanel | 1 Cyberpanel | 2025-09-05 | 6.1 Medium |
| CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php. | ||||
| CVE-2024-51112 | 1 Pnetlab | 1 Pnetlab | 2025-09-05 | 6.1 Medium |
| Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script | ||||
| CVE-2024-51111 | 1 Pnetlab | 1 Pnetlab | 2025-09-05 | 4.1 Medium |
| Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of the victim's browser. | ||||
| CVE-2024-55529 | 1 Zblogcn | 1 Z-blogphp | 2025-09-05 | 9.8 Critical |
| Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template. | ||||
| CVE-2024-55074 | 1 Grocy Project | 1 Grocy | 2025-09-05 | 8.8 High |
| The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370. | ||||
| CVE-2024-41206 | 1 Justdan96 | 1 Tsmuxer | 2025-09-05 | 6.5 Medium |
| A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted TS video file. | ||||
| CVE-2024-41209 | 1 Justdan96 | 1 Tsmuxer | 2025-09-05 | 8.8 High |
| A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted MOV video file. | ||||
| CVE-2024-41217 | 1 Justdan96 | 1 Tsmuxer | 2025-09-05 | 6.5 Medium |
| A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted MKV video file. | ||||
| CVE-2024-49776 | 1 Justdan96 | 1 Tsmuxer | 2025-09-05 | 6.5 Medium |
| A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS video file. | ||||
| CVE-2024-49777 | 1 Justdan96 | 1 Tsmuxer | 2025-09-05 | 8.8 High |
| A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS), Information Disclosure and Code Execution via a crafted MKV video file. | ||||
| CVE-2024-49778 | 1 Justdan96 | 1 Tsmuxer | 2025-09-05 | 8.8 High |
| A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted MOV video file. | ||||
| CVE-2024-52520 | 1 Nextcloud | 2 Nextcloud Enterprise Server, Nextcloud Server | 2025-09-05 | 5.7 Medium |
| Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. | ||||
| CVE-2024-52509 | 1 Nextcloud | 1 Mail | 2025-09-04 | 3.5 Low |
| Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. | ||||
| CVE-2024-51503 | 1 Trendmicro | 1 Deep Security Agent | 2025-09-04 | 8 High |
| A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate access to the domain may be able to remotely inject commands to other machines in the same domain. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability locally and must have domain user privileges to affect other machines. | ||||
| CVE-2024-52802 | 1 Riot-os | 1 Riot | 2025-09-04 | 7.5 High |
| RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/application_layer/dhcpv6/client.c`, has no minimum header length check for `dhcpv6_opt_t` after processing `dhcpv6_msg_t`. This omission could lead to an out-of-bound read, causing system inconsistency. Additionally, the same lack of a header length check is present in the function `_preparse_advertise`, which is called by `_parse_advertise` before handling the request. As of time of publication, no known patched version exists. | ||||