NVD公開月 2026-01
5,143 件。全詳細JSONは data/nvd/、個別Markdownは重点対象のみ（全件生成も可能）。
| CVE | 状態 | KEV | CWE | 概要（先頭180文字） |
|---|---|---|---|---|
| CVE-2011-10041 | Deferred | 未確認 | CWE-434 | Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthentic |
| CVE-2012-10064 | Deferred | 未確認 | CWE-434 | Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files |
| CVE-2016-15057 | Analyzed | 未確認 | CWE-77 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Co |
| CVE-2017-20212 | Deferred | 未確認 | CWE-22 | FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows unauthenticated attackers to read arbitrary files through unver |
| CVE-2017-20213 | Deferred | 未確認 | CWE-306 | FLIR Thermal Camera F/FC/PT/D Stream firmware version 8.0.0.64 contains an unauthenticated vulnerability that allows remote attackers to access live camera streams without credenti |
| CVE-2017-20214 | Deferred | 未確認 | CWE-798 | FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed through normal camera operations. Attackers can leverage these pe |
| CVE-2017-20215 | Deferred | 未確認 | CWE-78 | FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell commands with root privile |
| CVE-2017-20216 | Deferred | 未確認 | CWE-78 | FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.php script. Attackers |
| CVE-2018-25116 | Analyzed | 未確認 | CWE-79 | MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malicious SVG scripts that |
| CVE-2018-25132 | Analyzed | 未確認 | CWE-79 | MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attackers can modify thread t |
| CVE-2019-25231 | Deferred | 未確認 | CWE-428 | devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows local non-privileged users to potentially execute arbitrary code |
| CVE-2019-25232 | Deferred | 未確認 | CWE-120 | NetPCLinker 1.0.0.0 contains a buffer overflow vulnerability in the Clients Control Panel DNS/IP field that allows attackers to execute arbitrary shellcode. Attackers can craft a m |
| CVE-2019-25259 | Deferred | 未確認 | CWE-352 | Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request valid |
| CVE-2019-25268 | Deferred | 未確認 | CWE-427 | NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files from remote shares. Att |
| CVE-2019-25270 | Deferred | 未確認 | CWE-79 | SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the 'senddata' POST parameter of logged_page.php that allows attackers to inject malicious script |
| CVE-2019-25277 | Analyzed | 未確認 | CWE-79 | FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. |
| CVE-2019-25278 | Modified | 未確認 | CWE-319 | FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform m |
| CVE-2019-25279 | Modified | 未確認 | CWE-312 | FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. |
| CVE-2019-25280 | Deferred | 未確認 | CWE-79 | Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML code through the 'speed' GET parameter. Attackers can inject m |
| CVE-2019-25282 | Deferred | 未確認 | CWE-601 | V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to manipulate the 'parent' GET parameter. Attackers can craft malicio |
| CVE-2019-25284 | Deferred | 未確認 | CWE-79 | V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper input sanitization in various script parameters. Attackers can e |
| CVE-2019-25289 | Deferred | 未確認 | CWE-78 | SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'testemail' module. Atta |
| CVE-2019-25290 | Deferred | 未確認 | CWE-918 | Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can expl |
| CVE-2019-25291 | Deferred | 未確認 | CWE-798 | INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers |
| CVE-2019-25295 | Deferred | 未確認 | CWE-22 | The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrit |
| CVE-2019-25296 | Deferred | 未確認 | CWE-434 | The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX |
| CVE-2019-25297 | Deferred | 未確認 | CWE-79 | Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due t |
| CVE-2020-36875 | Deferred | 未確認 | CWE-94 | AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error |
| CVE-2020-36905 | Deferred | 未確認 | CWE-829 | FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attacke |
| CVE-2020-36906 | Deferred | 未確認 | CWE-352 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft |
| CVE-2020-36907 | Deferred | 未確認 | CWE-770 | Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a craf |
| CVE-2020-36908 | Analyzed | 未確認 | CWE-352 | SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. At |
| CVE-2020-36909 | Analyzed | 未確認 | CWE-22 | SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI |
| CVE-2020-36910 | Deferred | 未確認 | CWE-78 | Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' |
| CVE-2020-36911 | Analyzed | 未確認 | CWE-798 | Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forge |
| CVE-2020-36912 | Deferred | 未確認 | CWE-601 | Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the 'pagina' GET paramete |
| CVE-2020-36913 | Deferred | 未確認 | CWE-384 | All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the login process. Attack |
| CVE-2020-36914 | Deferred | 未確認 | CWE-319 | QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication credentials through c |
| CVE-2020-36915 | Deferred | 未確認 | CWE-1392, CWE-798 | Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. |
| CVE-2020-36916 | Deferred | 未確認 | CWE-732 | TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. Attackers can leverage the 'Modi |
| CVE-2020-36917 | Deferred | 未確認 | CWE-319 | iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication credentials through cleart |
| CVE-2020-36918 | Deferred | 未確認 | CWE-352 | iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attac |
| CVE-2020-36919 | Analyzed | 未確認 | CWE-79 | WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php |
| CVE-2020-36920 | Deferred | 未確認 | CWE-863 | iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. |
| CVE-2020-36921 | Deferred | 未確認 | CWE-548 | RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive webserver log files. Attackers c |
| CVE-2020-36922 | Analyzed | 未確認 | CWE-497 | Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. A |
| CVE-2020-36923 | Analyzed | 未確認 | CWE-639 | Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden sys |
| CVE-2020-36924 | Modified | 未確認 | CWE-829 | Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL para |
| CVE-2020-36925 | Deferred | 未確認 | CWE-331 | Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can br |
| CVE-2020-36926 | Analyzed | 未確認 | CWE-497 | SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable |
| CVE-2020-36927 | Analyzed | 未確認 | CWE-428 | DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. |
| CVE-2020-36928 | Analyzed | 未確認 | CWE-428 | Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in |
| CVE-2020-36929 | Analyzed | 未確認 | CWE-428 | Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially execute arbitrary cod |
| CVE-2020-36930 | Analyzed | 未確認 | CWE-428 | SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbitrary code. Attackers |
| CVE-2020-36931 | Deferred | 未確認 | CWE-79 | Click2Magic 1.1.5 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts in the chat name input. Attackers can craft a malicious pay |
| CVE-2020-36932 | Modified | 未確認 | CWE-79 | SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will |
| CVE-2020-36933 | Deferred | 未確認 | CWE-428 | HTC IPTInstaller 4.0.9 contains an unquoted service path vulnerability in the PassThru Service configuration. Attackers can exploit the unquoted binary path to inject and execute m |
| CVE-2020-36934 | Deferred | 未確認 | CWE-428 | Deep Instinct Windows Agent 1.2.24.0 contains an unquoted service path vulnerability in the DeepNetworkService that allows local users to potentially execute code with elevated pri |
| CVE-2020-36935 | Deferred | 未確認 | CWE-428 | KMSpico 17.1.0.0 contains an unquoted service path vulnerability in the Service KMSELDI configuration that allows local attackers to potentially execute arbitrary code. Attackers c |
| CVE-2020-36936 | Deferred | 未確認 | CWE-428 | Magic Mouse 2 Utilities 2.20 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to inject malicious execu |
| CVE-2020-36937 | Deferred | 未確認 | CWE-428 | Microvirt MEMU Play 3.7.0 contains an unquoted service path vulnerability in the MEmusvc Windows service that allows local attackers to potentially execute arbitrary code. Attacker |
| CVE-2020-36938 | Deferred | 未確認 | CWE-732 | WinAVR version 20100110 contains an insecure permissions vulnerability that allows authenticated users to modify system files and executables. Attackers can leverage the overly per |
| CVE-2020-36939 | Deferred | 未確認 | CWE-22 | Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers |
| CVE-2020-36940 | Deferred | 未確認 | CWE-120 | Easy CD & DVD Cover Creator 4.13 contains a buffer overflow vulnerability in the serial number input field that allows attackers to crash the application. Attackers can generate a |
| CVE-2020-36941 | Analyzed | 未確認 | CWE-1236 | Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate |
| CVE-2020-36942 | Analyzed | 未確認 | CWE-434 | Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a P |
| CVE-2020-36943 | Deferred | 未確認 | CWE-770 | aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with excessive data. Attackers |
| CVE-2020-36944 | Analyzed | 未確認 | CWE-918 | ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Atta |
| CVE-2020-36945 | Deferred | 未確認 | CWE-89 | WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating email credentials |
| CVE-2020-36946 | Analyzed | 未確認 | CWE-770 | SyncBreeze 10.0.28 contains a denial of service vulnerability in the login endpoint that allows remote attackers to crash the service. Attackers can send an oversized payload in th |
| CVE-2020-36947 | Analyzed | 未確認 | CWE-89 | LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can |
| CVE-2020-36948 | Deferred | 未確認 | CWE-863 | VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient t |
| CVE-2020-36949 | Analyzed | 未確認 | CWE-770 | TapinRadio 2.13.7 contains a denial of service vulnerability in the application proxy settings that allows attackers to crash the program by overflowing input fields. Attackers can |
| CVE-2020-36950 | Deferred | 未確認 | CWE-770 | Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send sim |
| CVE-2020-36951 | Deferred | 未確認 | CWE-89 | Phpscript-sgh 0.1.0 contains a time-based blind SQL injection vulnerability in the admin interface that allows attackers to manipulate database queries through the 'id' parameter. |
| CVE-2020-36952 | Deferred | 未確認 | CWE-428 | IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit |
| CVE-2020-36953 | Deferred | 未確認 | CWE-428 | MiniTool ShadowMaker 3.2 contains an unquoted service path vulnerability in the MTAgentService that allows local attackers to potentially execute arbitrary code. Attackers can expl |
| CVE-2020-36954 | Deferred | 未確認 | CWE-79 | Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject malicious scripts. Att |
| CVE-2020-36955 | Deferred | 未確認 | CWE-79 | Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the page t |
| CVE-2020-36956 | Deferred | 未確認 | CWE-79 | Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers c |
| CVE-2020-36957 | Deferred | 未確認 | CWE-428 | PDF Complete 3.5.310.2002 contains an unquoted service path vulnerability in its pdfsvc.exe service configuration. Attackers can exploit the unquoted path to inject and execute mal |
| CVE-2020-36958 | Deferred | 未確認 | CWE-428 | Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers c |
| CVE-2020-36959 | Deferred | 未確認 | CWE-428 | IDT PC Audio 1.0.6499.0 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can |
| CVE-2020-36960 | Deferred | 未確認 | CWE-79 | Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fields. Attackers can cra |
| CVE-2020-36961 | Deferred | 未確認 | CWE-121 | 10-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows remote attackers to execute arbitrary code. Attackers can craft |
| CVE-2020-36962 | Analyzed | 未確認 | CWE-1236 | Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can sub |
| CVE-2020-36963 | Deferred | 未確認 | CWE-306 | Intelbras Router RF 301K firmware version 1.1.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to download router configuration files. Attack |
| CVE-2020-36964 | Deferred | 未確認 | CWE-787 | YATinyWinFTP contains a denial of service vulnerability that allows attackers to crash the FTP service by sending a 272-byte buffer with a trailing space. Attackers can exploit the |
| CVE-2020-36965 | Deferred | 未確認 | CWE-121 | docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to execute arbitrary code by overwriting memory. Attackers can cr |
| CVE-2020-36966 | Deferred | 未確認 | CWE-79 | Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts through multiple paramet |
| CVE-2020-36967 | Deferred | 未確認 | CWE-121 | Zortam Mp3 Media Studio 27.60 contains a buffer overflow vulnerability in the library creation file selection process that allows remote code execution. Attackers can craft a malic |
| CVE-2020-36968 | Analyzed | 未確認 | CWE-522 | M/Monit 3.7.4 contains an authentication vulnerability that allows authenticated attackers to retrieve user password hashes through an administrative API endpoint. Attackers can se |
| CVE-2020-36969 | Analyzed | 未確認 | CWE-863 | M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POS |
| CVE-2020-36970 | Deferred | 未確認 | CWE-22 | PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can expl |
| CVE-2020-36971 | Deferred | 未確認 | CWE-121 | Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter. Attackers can craft a malicious payload and paste it |
| CVE-2020-36972 | Analyzed | 未確認 | CWE-89 | SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database information. Attackers c |
| CVE-2020-36973 | Deferred | 未確認 | CWE-434 | PDW File Browser 1.3 contains a remote code execution vulnerability that allows authenticated users to upload and rename webshell files to arbitrary web server locations. Attackers |
| CVE-2020-36974 | Deferred | 未確認 | CWE-428 | Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. At |
| CVE-2020-36975 | Deferred | 未確認 | CWE-428 | EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploiting the service binar |
| CVE-2020-36976 | Deferred | 未確認 | CWE-428 | Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially execute arbitrary code. |
| CVE-2020-36977 | Deferred | 未確認 | CWE-428 | Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious co |
| CVE-2020-36978 | Deferred | 未確認 | CWE-79 | Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts throu |
| CVE-2020-36979 | Deferred | 未確認 | CWE-428 | Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path by placing |
| CVE-2020-36980 | Deferred | 未確認 | CWE-428 | SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Att |
| CVE-2020-36981 | Deferred | 未確認 | CWE-428 | Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users to potentially execute arbitrary code. Attackers can exploi |
| CVE-2020-36982 | Deferred | 未確認 | CWE-428 | Motorola Device Manager 2.5.4 contains an unquoted service path vulnerability in the MotoHelperService.exe service that allows local users to potentially inject malicious code. Att |
| CVE-2020-36983 | Deferred | 未確認 | CWE-428 | Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during service startup. Attackers can exploit th |
| CVE-2020-36984 | Deferred | 未確認 | CWE-428 | EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute code with elevated system privileges. Attackers can exploit |
| CVE-2020-36985 | Deferred | 未確認 | CWE-428 | IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploi |
| CVE-2020-36986 | Deferred | 未確認 | CWE-428 | Prey 1.9.6 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in |
| CVE-2020-36987 | Deferred | 未確認 | CWE-428 | Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers |
| CVE-2020-36988 | Deferred | 未確認 | CWE-79 | PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through file rename a |
| CVE-2020-36989 | Deferred | 未確認 | CWE-428 | ForensiT AppX Management Service 2.2.0.4 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileg |
| CVE-2020-36990 | Deferred | 未確認 | CWE-428 | Input Director 1.4.3 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute code with elevated privileges. Atta |
| CVE-2020-36991 | Deferred | 未確認 | CWE-428 | ShareMouse 5.0.43 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can explo |
| CVE-2020-36992 | Deferred | 未確認 | CWE-428 | Nord VPN 6.31.13.0 contains an unquoted service path vulnerability in its nordvpn-service that allows local attackers to execute code with elevated privileges. Attackers can exploi |
| CVE-2020-36993 | Modified | 未確認 | CWE-79 | LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts thro |
| CVE-2020-36994 | Deferred | 未確認 | CWE-120 | QlikView 12.50.20000.0 contains a denial of service vulnerability in the FTP server address input field that allows local attackers to crash the application. Attackers can paste a |
| CVE-2020-36995 | Deferred | 未確認 | CWE-120 | Mocha Telnet Lite for iOS 4.2 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the user configuration input. Attackers can |
| CVE-2020-36996 | Deferred | 未確認 | CWE-79 | PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content. Attackers can injec |
| CVE-2020-36997 | Deferred | 未確認 | CWE-121 | BacklinkSpeed 2.4 contains a buffer overflow vulnerability that allows attackers to corrupt the Structured Exception Handler (SEH) chain through malicious file import. Attackers ca |
| CVE-2020-36998 | Deferred | 未確認 | CWE-79 | Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject malicious scripts in |
| CVE-2020-36999 | Deferred | 未確認 | CWE-89 | Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection. Attackers can bypas |
| CVE-2020-37000 | Deferred | 未確認 | CWE-121 | Free MP3 CD Ripper 2.8 contains a stack buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting a malicious WAV file with oversized payload |
| CVE-2020-37001 | Deferred | 未確認 | CWE-121 | Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overflowing the 'Archive To |
| CVE-2020-37002 | Deferred | 未確認 | CWE-78 | Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can |
| CVE-2020-37003 | Deferred | 未確認 | CWE-79 | Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module that allows attackers to inject malicious scripts. Attackers c |
| CVE-2020-37004 | Deferred | 未確認 | CWE-89 | The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users da |
| CVE-2020-37005 | Deferred | 未確認 | CWE-89 | TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames by manipulating the 'notes' parameter. A |
| CVE-2020-37006 | Deferred | 未確認 | CWE-89 | berliCRM 1.0.24 contains a SQL injection vulnerability in the 'src_record' parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL |
| CVE-2020-37007 | Modified | 未確認 | CWE-352 | Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malic |
| CVE-2020-37008 | Deferred | 未確認 | CWE-639 | EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers |
| CVE-2020-37009 | Deferred | 未確認 | CWE-434 | MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload malicious PHP files. Attackers can exploit the u |
| CVE-2020-37010 | Deferred | 未確認 | CWE-120 | BearShare Lite 5.2.5 contains a buffer overflow vulnerability in the Advanced Search keywords input that allows attackers to execute arbitrary code. Attackers can craft a specially |
| CVE-2020-37011 | Deferred | 未確認 | CWE-787 | Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font file. Attackers can gene |
| CVE-2020-37012 | Deferred | 未確認 | CWE-78 | Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can |
| CVE-2020-37013 | Deferred | 未確認 | CWE-121 | Audio Playback Recorder 3.2.2 contains a local buffer overflow vulnerability in the eject and registration parameters that allows attackers to execute arbitrary code. Attackers can |
| CVE-2020-37014 | Deferred | 未確認 | CWE-79 | Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit t |
| CVE-2020-37015 | Deferred | 未確認 | CWE-22 | The Ruijie Networks Switch eWeb S29_RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by |
| CVE-2020-37016 | Deferred | 未確認 | CWE-428 | BarcodeOCR 19.3.6 contains an unquoted service path vulnerability that allows local attackers to execute code with elevated privileges during system startup. Attackers can exploit |
| CVE-2020-37017 | Deferred | 未確認 | CWE-428 | CodeMeter 6.60 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit |
| CVE-2020-37018 | Deferred | 未確認 | CWE-79 | GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through message subjects. Attackers can craft m |
| CVE-2020-37019 | Deferred | 未確認 | CWE-79 | Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create |
| CVE-2020-37020 | Deferred | 未確認 | CWE-428 | SonarQube 8.3.1 contains an unquoted service path vulnerability that allows local attackers to gain SYSTEM privileges by exploiting the service executable path. Attackers can repla |
| CVE-2020-37021 | Deferred | 未確認 | CWE-428 | 10-Strike Bandwidth Monitor 3.9 contains an unquoted service path vulnerability in multiple services that allows local attackers to escalate privileges. Attackers can place a malic |
| CVE-2020-37022 | Deferred | 未確認 | CWE-79 | OpenZ ERP 3.6.60 contains a persistent cross-site scripting vulnerability in the Employee module's name and description parameters. Attackers can inject malicious scripts through P |
| CVE-2020-37023 | Deferred | 未確認 | CWE-434 | Koken CMS 0.22.24 contains a file upload vulnerability that allows authenticated attackers to bypass file extension restrictions by renaming malicious PHP files. Attackers can uplo |
| CVE-2020-37024 | Deferred | 未確認 | CWE-120 | Nidesoft DVD Ripper 5.2.18 contains a local buffer overflow vulnerability in the License Code registration parameter that allows attackers to execute arbitrary code. Attackers can |
| CVE-2020-37025 | Deferred | 未確認 | CWE-120 | Port Forwarding Wizard 4.8.0 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code through a long request in the Register feature. Attacker |
| CVE-2020-37026 | Deferred | 未確認 | CWE-352 | Sickbeard alpha contains a cross-site request forgery vulnerability that allows attackers to disable authentication by submitting crafted configuration parameters. Attackers can tr |
| CVE-2020-37027 | Deferred | 未確認 | CWE-78 | Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attac |
| CVE-2020-37028 | Deferred | 未確認 | CWE-120 | Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that allows attackers to execute arbitrary cod |
| CVE-2020-37029 | Deferred | 未確認 | CWE-120 | FTPDummy 4.80 contains a local buffer overflow vulnerability in its preference file handling that allows attackers to execute arbitrary code. Attackers can craft a malicious prefer |
| CVE-2020-37030 | Deferred | 未確認 | CWE-428 | Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can e |
| CVE-2020-37031 | Deferred | 未確認 | CWE-787 | Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory through the 'File' input parameter. |
| CVE-2020-37032 | Analyzed | 未確認 | CWE-78 | Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage |
| CVE-2020-37033 | Deferred | 未確認 | CWE-89 | Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' parameter in login requests. Attackers c |
| CVE-2020-37034 | Deferred | 未確認 | CWE-22 | HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepath and filename parameters. Attackers can |
| CVE-2020-37035 | Deferred | 未確認 | CWE-89 | e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unvalidated user input. |
| CVE-2020-37036 | Deferred | 未確認 | CWE-120 | RM Downloader 2.50.60 contains a local buffer overflow vulnerability in the 'Load' parameter that allows attackers to execute arbitrary code by overwriting memory. Attackers can cr |
| CVE-2020-37038 | Deferred | 未確認 | CWE-770 | Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field. Attackers can paste |
| CVE-2020-37039 | Deferred | 未確認 | CWE-770 | Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the command line interface. Attackers can gener |
| CVE-2020-37040 | Deferred | 未確認 | CWE-120 | Code Blocks 17.12 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious file name with Unicode characters. Attacker |
| CVE-2020-37041 | Analyzed | 未確認 | CWE-22 | OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted |
| CVE-2020-37042 | Deferred | 未確認 | CWE-120 | Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the 'Find Computer' feature that allows attackers to execute arbitrary code by overflowing the compu |
| CVE-2020-37043 | Deferred | 未確認 | CWE-120 | 10-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections through carefully crafted input. Attacke |
| CVE-2020-37044 | Analyzed | 未確認 | CWE-79 | OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET re |
| CVE-2020-37046 | Deferred | 未確認 | CWE-352 | Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users through the tambahuser.ph |
| CVE-2020-37049 | Deferred | 未確認 | CWE-120 | Frigate 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows attackers to execute arbitrary code. Attackers can craft a malicious pay |
| CVE-2020-37050 | Deferred | 未確認 | CWE-120 | Quick Player 1.3 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious .m3l file with carefully constructed payload. Atta |
| CVE-2020-37051 | Analyzed | 未確認 | CWE-89 | Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes. Attackers can exploi |
| CVE-2020-37052 | Deferred | 未確認 | CWE-94 | AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java |
| CVE-2020-37053 | Analyzed | 未確認 | CWE-89 | Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' parameter in comments. Attack |
| CVE-2020-37054 | Analyzed | 未確認 | CWE-352 | Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attackers can trick authent |
| CVE-2020-37056 | Deferred | 未確認 | CWE-290 | Crystal Shard http-protection 0.2.0 contains an IP spoofing vulnerability that allows attackers to bypass protection middleware by manipulating request headers. Attackers can hardc |
| CVE-2020-37057 | Analyzed | 未確認 | CWE-89 | Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' parameter. Attackers ca |
| CVE-2020-37058 | Deferred | 未確認 | CWE-428 | Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can exploit the unquoted path to inject mal |
| CVE-2020-37059 | Deferred | 未確認 | CWE-428 | Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers |
| CVE-2020-37060 | Deferred | 未確認 | CWE-428 | Atomic Alarm Clock 6.3 contains a local privilege escalation vulnerability in its service configuration that allows attackers to execute arbitrary code with SYSTEM privileges. Atta |
| CVE-2020-8451 | Rejected | 未確認 | Rejected reason: The reserved CVE was never used. | |
| CVE-2020-8452 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8453 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8454 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8455 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8456 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8457 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8458 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8459 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2020-8460 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2021-3926 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2021-41074 | Analyzed | 未確認 | CWE-352 | A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. |
| CVE-2021-47746 | Deferred | 未確認 | CWE-73 | NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. |
| CVE-2021-47748 | Analyzed | 未確認 | CWE-78 | Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject c |
| CVE-2021-47749 | Modified | 未確認 | CWE-22 | YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests |
| CVE-2021-47750 | Analyzed | 未確認 | CWE-79 | YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page. Attackers ca |
| CVE-2021-47751 | Modified | 未確認 | CWE-22 | CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arb |
| CVE-2021-47752 | Analyzed | 未確認 | CWE-770 | AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the server by sending multiple concurrent HTTP requests. Attackers |
| CVE-2021-47753 | Analyzed | 未確認 | CWE-434 | phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension checks. Attackers ca |
| CVE-2021-47754 | Modified | 未確認 | CWE-352 | Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious f |
| CVE-2021-47755 | Modified | 未確認 | CWE-22 | Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet |
| CVE-2021-47756 | Deferred | 未確認 | CWE-732 | Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the |
| CVE-2021-47757 | Analyzed | 未確認 | CWE-434 | Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a |
| CVE-2021-47758 | Analyzed | 未確認 | CWE-434 | Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module uplo |
| CVE-2021-47759 | Deferred | 未確認 | CWE-522 | MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH connection passwords through Windows PowerShell process listing. |
| CVE-2021-47760 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate. | |
| CVE-2021-47761 | Deferred | 未確認 | CWE-276 | MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can r |
| CVE-2021-47762 | Deferred | 未確認 | CWE-428 | HTTPDebuggerPro 9.11 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers ca |
| CVE-2021-47763 | Deferred | 未確認 | CWE-89 | Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the |
| CVE-2021-47764 | Modified | 未確認 | CWE-787 | AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Atta |
| CVE-2021-47765 | Modified | 未確認 | CWE-787 | AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report fields. Attackers can |
| CVE-2021-47766 | Deferred | 未確認 | CWE-89 | Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that allows attackers to manipulate database queries. Attackers |
| CVE-2021-47767 | Analyzed | 未確認 | CWE-428 | 10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers ca |
| CVE-2021-47768 | Analyzed | 未確認 | CWE-79 | ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers |
| CVE-2021-47769 | Modified | 未確認 | CWE-79 | Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user |
| CVE-2021-47770 | Deferred | 未確認 | CWE-94 | OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration in |
| CVE-2021-47771 | Modified | 未確認 | CWE-770 | RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the application. Attackers can add oversized entries |
| CVE-2021-47772 | Analyzed | 未確認 | CWE-787 | 10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft |
| CVE-2021-47773 | Analyzed | 未確認 | CWE-428 | Dynojet Power Core 2.3.0 contains an unquoted service path vulnerability in the DJ.UpdateService that allows local authenticated users to potentially execute code with elevated pri |
| CVE-2021-47774 | Deferred | 未確認 | CWE-787 | Kingdia CD Extractor 3.0.2 contains a buffer overflow vulnerability in the registration name field that allows attackers to execute arbitrary code. Attackers can craft a malicious |
| CVE-2021-47775 | Deferred | 未確認 | CWE-787 | YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the St |
| CVE-2021-47776 | Analyzed | 未確認 | CWE-918 | Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. |
| CVE-2021-47777 | Deferred | 未確認 | CWE-89 | Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inject stacked SQL queri |
| CVE-2021-47778 | Analyzed | 未確認 | CWE-94 | GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration pa |
| CVE-2021-47779 | Modified | 未確認 | CWE-79 | Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers ca |
| CVE-2021-47780 | Analyzed | 未確認 | CWE-428 | Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploi |
| CVE-2021-47781 | Deferred | 未確認 | CWE-787 | Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of service condition through a maliciously crafted .cmd file. Attac |
| CVE-2021-47782 | Deferred | 未確認 | CWE-89 | Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious database queries. Attackers |
| CVE-2021-47783 | Analyzed | 未確認 | CWE-434 | Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG pay |
| CVE-2021-47784 | Deferred | 未確認 | CWE-770 | Cyberfox Web Browser 52.9.1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the search bar with excessive data. Attackers c |
| CVE-2021-47785 | Analyzed | 未確認 | CWE-787 | Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. Attackers can craft a malicious payload to over |
| CVE-2021-47786 | Analyzed | 未確認 | CWE-787 | Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests. Attackers can send a cr |
| CVE-2021-47787 | Analyzed | 未確認 | CWE-428 | TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious executables in specif |
| CVE-2021-47788 | Analyzed | 未確認 | CWE-434 | WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can explo |
| CVE-2021-47789 | Analyzed | 未確認 | CWE-121, CWE-787 | Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending oversized input. Attackers can exploit |
| CVE-2021-47790 | Analyzed | 未確認 | CWE-428 | Active WebCam 11.5 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the |
| CVE-2021-47791 | Analyzed | 未確認 | CWE-770 | SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulation. Attackers can tri |
| CVE-2021-47792 | Analyzed | 未確認 | CWE-428 | Remote Mouse 4.002 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the |
| CVE-2021-47793 | Analyzed | 未確認 | CWE-770 | Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized message payload. Attackers can generate a 9 |
| CVE-2021-47794 | Analyzed | 未確認 | CWE-78 | ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can expl |
| CVE-2021-47795 | Deferred | 未確認 | CWE-22 | GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code execution through improper input sanitization. |
| CVE-2021-47796 | Deferred | 未確認 | CWE-1242, CWE-306 | Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the primary web interface on |
| CVE-2021-47797 | Deferred | 未確認 | CWE-120 | Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized payload in the activation keycode fie |
| CVE-2021-47798 | Deferred | 未確認 | CWE-120 | NoteBurner 2.35 contains a buffer overflow vulnerability in the license code input field that allows attackers to crash the application. Attackers can generate a 6000-byte payload |
| CVE-2021-47799 | Deferred | 未確認 | CWE-266 | Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit |
| CVE-2021-47800 | Deferred | 未確認 | CWE-352 | b2evolution 7.2.2 contains a cross-site request forgery vulnerability that allows attackers to modify admin account details without authentication. Attackers can craft a malicious |
| CVE-2021-47801 | Deferred | 未確認 | CWE-89 | Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit this vulnerability by |
| CVE-2021-47802 | Analyzed | 未確認 | CWE-306 | Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send |
| CVE-2021-47803 | Deferred | 未確認 | CWE-428 | iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privileges. Attackers can i |
| CVE-2021-47804 | Deferred | 未確認 | CWE-428 | Wise Care 365 5.6.7.568 contains an unquoted service path vulnerability in the WiseBootAssistant service running with LocalSystem privileges. Attackers can exploit this by insertin |
| CVE-2021-47805 | Analyzed | 未確認 | CWE-428 | Disk Savvy 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers |
| CVE-2021-47806 | Analyzed | 未確認 | CWE-428 | Dup Scout 13.5.28 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers |
| CVE-2021-47807 | Analyzed | 未確認 | CWE-428 | Sync Breeze 13.6.18 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attacker |
| CVE-2021-47808 | Modified | 未確認 | CWE-79 | Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code th |
| CVE-2021-47809 | Analyzed | 未確認 | CWE-428 | Disk Sorter Enterprise 13.6.12 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary cod |
| CVE-2021-47810 | Analyzed | 未確認 | CWE-428 | WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary code. Attackers can exp |
| CVE-2021-47811 | Modified | 未確認 | CWE-89 | Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL |
| CVE-2021-47812 | Modified | 未確認 | CWE-862 | GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Att |
| CVE-2021-47813 | Deferred | 未確認 | CWE-120 | Backup Key Recovery 2.2.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Attackers can |
| CVE-2021-47814 | Analyzed | 未確認 | CWE-120 | NBMonitor 1.6.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Attackers can paste a 25 |
| CVE-2021-47815 | Analyzed | 未確認 | CWE-120 | Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can paste a large buffer o |
| CVE-2021-47816 | Deferred | 未確認 | CWE-78 | Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management |
| CVE-2021-47817 | Modified | 未確認 | CWE-79 | OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file upload to achieve remote code execution. |
| CVE-2021-47818 | Deferred | 未確認 | CWE-1284 | DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long character string in the Excluded text box |
| CVE-2021-47819 | Deferred | 未確認 | CWE-434 | ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution capabilities. Attackers |
| CVE-2021-47820 | Deferred | 未確認 | CWE-352 | Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. Attackers can craft a malicious webpage that |
| CVE-2021-47821 | Deferred | 未確認 | CWE-1284 | RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing network configuration fields with large character buffers |
| CVE-2021-47822 | Deferred | 未確認 | CWE-428 | DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to execute code with elevated privileges. Atta |
| CVE-2021-47823 | Deferred | 未確認 | CWE-428 | Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit |
| CVE-2021-47824 | Deferred | 未確認 | CWE-1284 | iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attackers can paste a 2,00 |
| CVE-2021-47825 | Deferred | 未確認 | CWE-428 | Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges. Attackers can exploit the u |
| CVE-2021-47826 | Deferred | 未確認 | CWE-428 | Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to potentially execute arbitrary code. Attacker |
| CVE-2021-47827 | Deferred | 未確認 | CWE-1284 | WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can tri |
| CVE-2021-47828 | Deferred | 未確認 | CWE-428 | BOOTP Turbo 2.0.0.1253 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to execute arbitrary code with |
| CVE-2021-47829 | Deferred | 未確認 | CWE-428 | DHCP Broadband 4.1.0.1503 contains an unquoted service path vulnerability in its service configuration that allows local attackers to execute code with elevated privileges. Attacke |
| CVE-2021-47830 | Analyzed | 未確認 | CWE-352 | GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticate |
| CVE-2021-47831 | Deferred | 未確認 | CWE-1284 | Sandboxie 5.49.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the container folder input field. Attackers can paste a la |
| CVE-2021-47832 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate. | |
| CVE-2021-47833 | Deferred | 未確認 | CWE-428 | WifiHotSpot 1.0.0.0 contains an unquoted service path vulnerability in its WifiHotSpotService.exe that allows local attackers to execute code with elevated privileges. Attackers ca |
| CVE-2021-47834 | Deferred | 未確認 | CWE-79 | Schlix CMS 2.2.6-6 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into category titles. Attackers can create a |
| CVE-2021-47835 | Deferred | 未確認 | CWE-79 | Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads in custom widget titles and files. Attackers can craft mali |
| CVE-2021-47836 | Deferred | 未確認 | CWE-79 | Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. Attackers can upload ma |
| CVE-2021-47837 | Deferred | 未確認 | CWE-79 | Markdownify 1.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers can upload crafted mar |
| CVE-2021-47838 | Deferred | 未確認 | CWE-79 | Markright 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to embed malicious payloads in markdown files. Attackers can upload specially crafted m |
| CVE-2021-47839 | Deferred | 未確認 | CWE-79 | Marky 0.0.1 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upload crafted markdown fi |
| CVE-2021-47840 | Deferred | 未確認 | CWE-79 | Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers can upload specially craf |
| CVE-2021-47841 | Deferred | 未確認 | CWE-79 | SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets. Attackers can execute arbitrary code by em |
| CVE-2021-47842 | Deferred | 未確認 | CWE-79 | StudyMD 0.3.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upload crafted markdown |
| CVE-2021-47843 | Analyzed | 未確認 | CWE-79 | Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers can execute arbitrary |
| CVE-2021-47844 | Deferred | 未確認 | CWE-79 | Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind mapping files or custom headers. Attackers can craft malicious |
| CVE-2021-47845 | Deferred | 未確認 | CWE-428 | Spy Emergency 25.0.650 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to execute code with elevated privileges. A |
| CVE-2021-47846 | Deferred | 未確認 | CWE-89 | Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentica |
| CVE-2021-47847 | Deferred | 未確認 | CWE-428 | Disk Sorter Server 13.6.12 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbitrary code. Attac |
| CVE-2021-47848 | Deferred | 未確認 | CWE-89 | Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter. Attackers can manipul |
| CVE-2021-47849 | Analyzed | 未確認 | CWE-22 | Mini Mouse 9.3.0 contains a path traversal vulnerability that allows attackers to access sensitive system directories through the device information endpoint. Attackers can retriev |
| CVE-2021-47850 | Analyzed | 未確認 | CWE-22 | Mini Mouse 9.2.0 contains a path traversal vulnerability that allows remote attackers to access arbitrary system files and directories through crafted HTTP requests. Attackers can |
| CVE-2021-47851 | Analyzed | 未確認 | CWE-78 | Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. Attackers can leverage |
| CVE-2021-47852 | Deferred | 未確認 | CWE-276 | Rockstar Games Launcher 1.0.37.349 contains a privilege escalation vulnerability that allows authenticated users to modify the service executable with weak permissions. Attackers c |
| CVE-2021-47853 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2021-47854 | Deferred | 未確認 | CWE-120 | DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers ca |
| CVE-2021-47855 | Deferred | 未確認 | CWE-79 | Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can cr |
| CVE-2021-47857 | Analyzed | 未確認 | CWE-79 | Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. Attackers can craft a |
| CVE-2021-47858 | Deferred | 未確認 | CWE-79 | Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface. Attackers can inject m |
| CVE-2021-47859 | Deferred | 未確認 | CWE-428 | ActivIdentity 8.2 contains an unquoted service path vulnerability in the ac.sharedstore service that allows local attackers to potentially execute arbitrary code. Attackers can exp |
| CVE-2021-47860 | Analyzed | 未確認 | CWE-352 | GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator |
| CVE-2021-47861 | Deferred | 未確認 | CWE-428 | Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers ca |
| CVE-2021-47862 | Deferred | 未確認 | CWE-428 | Hi-Rez Studios 5.1.6.3 contains an unquoted service path vulnerability in the HiPatchService that allows local attackers to execute code with elevated privileges. Attackers can exp |
| CVE-2021-47863 | Deferred | 未確認 | CWE-428 | MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability in its Encrypto Service configuration that allows local attackers to potentially execute arbitrary code. Attac |
| CVE-2021-47864 | Deferred | 未確認 | CWE-428 | OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service running with LocalSystem privileges. Attackers can exploit the unquot |
| CVE-2021-47865 | Deferred | 未確認 | CWE-770 | ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Attackers can repeatedly |
| CVE-2021-47866 | Deferred | 未確認 | CWE-428 | WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated system privileges. Attack |
| CVE-2021-47867 | Deferred | 未確認 | CWE-428 | WIN-PACK PRO4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to potentially execute code with elevated system privileges. Attacker |
| CVE-2021-47868 | Deferred | 未確認 | CWE-428 | WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges. Attackers |
| CVE-2021-47869 | Deferred | 未確認 | CWE-428 | Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service that allows local users to potentially execute arbitrary code. Attack |
| CVE-2021-47870 | Modified | 未確認 | CWE-79 | GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htmlspecialchars(), but |
| CVE-2021-47871 | Deferred | 未確認 | CWE-73 | Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint |
| CVE-2021-47872 | Deferred | 未確認 | CWE-89 | SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate database queries through the |
| CVE-2021-47873 | Deferred | 未確認 | CWE-79 | VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that allows attackers to inject malicious scripts. Attackers can e |
| CVE-2021-47874 | Deferred | 未確認 | CWE-428 | VFS for Git 1.0.21014.1 contains an unquoted service path vulnerability in the GVFS.Service Windows service that allows local attackers to execute code with elevated privileges. At |
| CVE-2021-47875 | Deferred | 未確認 | CWE-770 | GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by generating a large buffer overflow. Attackers can cre |
| CVE-2021-47876 | Deferred | 未確認 | CWE-770 | GeoGebra Classic 5.0.631.0-d contains a denial of service vulnerability in the input field that allows attackers to crash the application by sending oversized buffer content. Attac |
| CVE-2021-47877 | Deferred | 未確認 | CWE-770 | GeoGebra Graphing Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buffer. Attackers can gen |
| CVE-2021-47878 | Deferred | 未確認 | CWE-428 | eBeam Education Suite 2.5.0.9 contains an unquoted service path vulnerability in the eBeam Device Service that allows local users to potentially execute code with elevated privileg |
| CVE-2021-47879 | Deferred | 未確認 | CWE-428 | eBeam Interactive Suite 3.6 contains an unquoted service path vulnerability in the eBeam Stylus Driver service that allows local users to potentially execute code with elevated pri |
| CVE-2021-47880 | Deferred | 未確認 | CWE-428 | Realtek Wireless LAN Utility 700.1631 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers |
| CVE-2021-47881 | Deferred | 未確認 | CWE-121 | dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to overwrite memory by manipulating the milstd1553result.txt file. |
| CVE-2021-47882 | Deferred | 未確認 | CWE-428 | FreeLAN 2.2 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the un |
| CVE-2021-47883 | Deferred | 未確認 | CWE-428 | Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can expl |
| CVE-2021-47884 | Deferred | 未確認 | CWE-428 | OKI Configuration Tool 1.6.53 contains an unquoted service path vulnerability in the OKI Local Port Manager service that allows local attackers to potentially execute arbitrary cod |
| CVE-2021-47886 | Deferred | 未確認 | CWE-428 | Pingzapper 2.3.1 contains an unquoted service path vulnerability in the PingzapperSvc service that allows local attackers to potentially execute arbitrary code. Attackers can explo |
| CVE-2021-47887 | Deferred | 未確認 | CWE-428 | OKI Print Job Accounting 4.4.10 contains an unquoted service path vulnerability in the OkiJaSvc service that allows local attackers to potentially execute arbitrary code. Attackers |
| CVE-2021-47888 | Deferred | 未確認 | CWE-434 | Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files. Attackers can upload a P |
| CVE-2021-47889 | Deferred | 未確認 | CWE-428 | Softros LAN Messenger 9.6.4 contains an unquoted service path vulnerability in the SoftrosSpellChecker service that allows local attackers to potentially execute arbitrary code. At |
| CVE-2021-47890 | Deferred | 未確認 | CWE-428 | LogonExpert 8.1 contains an unquoted service path vulnerability in the LogonExpertSvc service running with LocalSystem privileges. Attackers can exploit the unquoted path to place |
| CVE-2021-47891 | Deferred | 未確認 | CWE-306 | Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. Attackers can exploit |
| CVE-2021-47892 | Deferred | 未確認 | CWE-79 | PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parameter of the purchase page. Attackers can inject malicious Jav |
| CVE-2021-47893 | Deferred | 未確認 | CWE-770 | AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers to crash the application by overflowing the host name input |
| CVE-2021-47894 | Deferred | 未確認 | CWE-770 | Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buffer. Attackers can gen |
| CVE-2021-47895 | Analyzed | 未確認 | CWE-770 | Nsauditor 3.2.2.0 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Event Description field with a large buffer. Attacker |
| CVE-2021-47896 | Deferred | 未確認 | CWE-428 | PDF Complete Corporate Edition 4.1.45 contains an unquoted service path vulnerability in the pdfcDispatcher service that allows local attackers to potentially execute arbitrary cod |
| CVE-2021-47897 | Deferred | 未確認 | CWE-79 | PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script. Attackers can inject malicious JavaScript payload |
| CVE-2021-47898 | Deferred | 未確認 | CWE-428 | Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMP_UDSA service running with LocalSystem privileges. Attackers can exploit the unquoted path by pl |
| CVE-2021-47899 | Deferred | 未確認 | CWE-434 | YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote file upload feature. At |
| CVE-2021-47900 | Deferred | 未確認 | CWE-98 | Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through manipulated HTTP h |
| CVE-2021-47901 | Deferred | 未確認 | CWE-1236 | Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject formulas through redirected endpoints. Attackers can craft m |
| CVE-2021-47902 | Deferred | 未確認 | CWE-89 | Testa Online Test Management System 3.4.7 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'q' search parameter. Attackers ca |
| CVE-2021-47903 | Deferred | 未確認 | CWE-78 | LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can injec |
| CVE-2021-47904 | Deferred | 未確認 | CWE-434 | PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by explo |
| CVE-2021-47905 | Analyzed | 未確認 | CWE-79 | MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field. Attackers can inject malicious scripts that will execute in |
| CVE-2021-47906 | Deferred | 未確認 | CWE-79 | BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers ca |
| CVE-2022-21130 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-22147 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-24380 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-24911 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-25369 | Deferred | 未確認 | CWE-287, CWE-288 | An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if |
| CVE-2022-32150 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-34214 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-40619 | Analyzed | 未確認 | CWE-77 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerab |
| CVE-2022-40620 | Analyzed | 未確認 | CWE-295 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update packages through its auto |
| CVE-2022-43558 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-43559 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-43560 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2022-50693 | Deferred | 未確認 | CWE-428 | Splashtop 8.71.12001.0 contains an unquoted service path vulnerability in the Splashtop Software Updater Service that allows local attackers to potentially execute arbitrary code. |
| CVE-2022-50805 | Deferred | 未確認 | CWE-89 | Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit |
| CVE-2022-50806 | Modified | 未確認 | CWE-94 | 4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attacker |
| CVE-2022-50807 | Rejected | 未確認 | Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. | |
| CVE-2022-50808 | Deferred | 未確認 | CWE-427 | CoolerMaster MasterPlus 1.8.5 contains an unquoted service path vulnerability in the MPService that allows local attackers to execute code with elevated system privileges. Attacker |
| CVE-2022-50890 | Analyzed | 未確認 | CWE-22 | Owlfiles File Manager 12.0.1 contains a path traversal vulnerability in its built-in HTTP server that allows attackers to access system directories. Attackers can exploit the vulne |
| CVE-2022-50891 | Modified | 未確認 | CWE-79 | Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP server endpoints. At |
| CVE-2022-50892 | Analyzed | 未確認 | CWE-89 | VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers can exploit the logi |
| CVE-2022-50893 | Analyzed | 未確認 | CWE-434 | VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a malicious PHP file through th |
| CVE-2022-50894 | Modified | 未確認 | CWE-89 | VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the img_id par |
| CVE-2022-50895 | Modified | 未確認 | CWE-89 | Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based |
| CVE-2022-50896 | Deferred | 未確認 | CWE-79 | Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Attackers can craft a spe |
| CVE-2022-50897 | Modified | 未確認 | CWE-98 | mPDF 7.0 contains a local file inclusion vulnerability that allows attackers to read arbitrary system files by manipulating annotation file parameters. Attackers can generate URL-e |
| CVE-2022-50898 | Modified | 未確認 | CWE-434 | NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP |
| CVE-2022-50899 | Analyzed | 未確認 | CWE-611 | Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server. Attackers can exploi |
| CVE-2022-50900 | Analyzed | 未確認 | CWE-428 | Wondershare Dr.Fone 12.0.18 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit |
| CVE-2022-50901 | Analyzed | 未確認 | CWE-428 | Wondershare Dr.Fone 11.4.9 contains an unquoted service path vulnerability in the DFWSIDService that allows local users to potentially execute arbitrary code. Attackers can exploit |
| CVE-2022-50902 | Deferred | 未確認 | CWE-91 | Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService that allows local users to potentially execute code with elevated privileges. Attackers ca |
| CVE-2022-50903 | Analyzed | 未確認 | CWE-428 | Wondershare MobileTrans 3.5.9 contains an unquoted service path vulnerability in the ElevationService that allows local users to potentially execute code with elevated system privi |
| CVE-2022-50904 | Deferred | 未確認 | CWE-428 | Wondershare UBackit 2.0.5 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers c |
| CVE-2022-50905 | Modified | 未確認 | CWE-79 | e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs in the news comment f |
| CVE-2022-50906 | Modified | 未確認 | CWE-79 | e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with |
| CVE-2022-50907 | Modified | 未確認 | CWE-434 | e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload |
| CVE-2022-50908 | Deferred | 未確認 | CWE-79 | Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can send crafted emails wi |
| CVE-2022-50909 | Deferred | 未確認 | CWE-78 | Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Atta |
| CVE-2022-50910 | Modified | 未確認 | CWE-640 | Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requests. Attackers can i |
| CVE-2022-50911 | Rejected | 未確認 | Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. | |
| CVE-2022-50912 | Analyzed | 未確認 | CWE-434 | ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload |
| CVE-2022-50913 | Deferred | 未確認 | CWE-428 | ITeC ITeCProteccioAppServer contains an unquoted service path vulnerability that allows local attackers to execute code with elevated system privileges. Attackers can insert a mali |
| CVE-2022-50914 | Deferred | 未確認 | CWE-428 | EaseUS Data Recovery 15.1.0.0 contains an unquoted service path vulnerability in the EaseUS UPDATE SERVICE executable. Attackers can exploit the unquoted path to inject and execute |
| CVE-2022-50915 | Modified | 未確認 | CWE-428 | PTPublisher 2.3.4 contains an unquoted service path vulnerability in the PTProtect service that allows local attackers to potentially execute arbitrary code with elevated privilege |
| CVE-2022-50916 | Modified | 未確認 | CWE-434 | e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attack |
| CVE-2022-50917 | Modified | 未確認 | CWE-428 | ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers |
| CVE-2022-50918 | Deferred | 未確認 | CWE-428 | VIVE Runtime Service 1.0.0.4 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploi |
| CVE-2022-50919 | Analyzed | 未確認 | CWE-78 | Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can explo |
| CVE-2022-50920 | Deferred | 未確認 | CWE-428 | Sandboxie-Plus 5.50.2 contains an unquoted service path vulnerability in the SbieSvc Windows service that allows local attackers to potentially execute arbitrary code. Attackers ca |
| CVE-2022-50921 | Modified | 未確認 | CWE-428 | WOW21 5.0.1.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can explo |
| CVE-2022-50922 | Deferred | 未確認 | CWE-120 | Audio Conversion Wizard v2.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory with a specially crafted registration c |
| CVE-2022-50923 | Modified | 未確認 | CWE-428 | Cobian Backup 0.9 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the unquo |
| CVE-2022-50924 | Deferred | 未確認 | CWE-428 | Private Internet Access 3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers |
| CVE-2022-50925 | Analyzed | 未確認 | CWE-346 | Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers |
| CVE-2022-50926 | Deferred | 未確認 | CWE-565 | WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's ' |
| CVE-2022-50927 | Deferred | 未確認 | CWE-266 | Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin group. Attackers can |
| CVE-2022-50928 | Modified | 未確認 | CWE-428 | BlueSoleilCS 5.4.277 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attacke |
| CVE-2022-50929 | Deferred | 未確認 | CWE-428 | Connectify Hotspot 2018 contains an unquoted service path vulnerability in its ConnectifyService executable that allows local attackers to potentially execute arbitrary code. Attac |
| CVE-2022-50930 | Deferred | 未確認 | CWE-428 | Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code with elevated privil |
| CVE-2022-50931 | Modified | 未確認 | CWE-732 | TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers can replace system ex |
| CVE-2022-50932 | Analyzed | 未確認 | CWE-22 | Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file path |
| CVE-2022-50933 | Modified | 未確認 | CWE-428 | Cain & Abel 4.9.56 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit |
| CVE-2022-50934 | Rejected | 未確認 | Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. | |
| CVE-2022-50935 | Deferred | 未確認 | CWE-428 | Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\Int |
| CVE-2022-50936 | Analyzed | 未確認 | CWE-434 | WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attac |
| CVE-2022-50937 | Modified | 未確認 | CWE-79 | Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malicious script code in li |
| CVE-2022-50938 | Deferred | 未確認 | CWE-428 | CONTPAQi AdminPAQ 14.0.0 contains an unquoted service path vulnerability in the AppKeyLicenseServer service running with LocalSystem privileges. Attackers can exploit the unquoted |
| CVE-2022-50939 | Analyzed | 未確認 | CWE-22, CWE-434 | e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnera |
| CVE-2023-22925 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-22926 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-22927 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-22928 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-22929 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-22930 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-22944 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-32718 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-32719 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-32720 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2023-36331 | Analyzed | 未確認 | CWE-639 | Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId |
| CVE-2023-37525 | Analyzed | 未確認 | CWE-497 | A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configurati |
| CVE-2023-49186 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Cor |
| CVE-2023-5069 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2023-50897 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Renamer: from n/a through 5 |
| CVE-2023-51513 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in INTINITUM FORM Geo Controller allows DOM-Based XSS.This issue affects G |
| CVE-2023-52212 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0. |
| CVE-2023-53984 | Deferred | 未確認 | CWE-428 | Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged users to potentially execute code with syst |
| CVE-2023-53985 | Analyzed | 未確認 | CWE-79 | Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input para |
| CVE-2023-54328 | Modified | 未確認 | CWE-120 | AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate a 7000-byte payload |
| CVE-2023-54329 | Analyzed | 未確認 | CWE-121, CWE-787 | Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow i |
| CVE-2023-54330 | Analyzed | 未確認 | CWE-121, CWE-787 | Inbit Messenger versions 4.6.0 to 4.9.0 contain a remote stack-based buffer overflow vulnerability that allows unauthenticated attackers to execute arbitrary code by sending malfor |
| CVE-2023-54331 | Modified | 未確認 | CWE-428 | Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can explo |
| CVE-2023-54332 | Analyzed | 未確認 | CWE-79 | Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can |
| CVE-2023-54333 | Deferred | 未確認 | CWE-89 | Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit t |
| CVE-2023-54334 | Analyzed | 未確認 | CWE-121, CWE-787 | Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allows attackers to execute arbitrary code. Attackers can exploit |
| CVE-2023-54335 | Analyzed | 未確認 | CWE-306 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this fla |
| CVE-2023-54336 | Deferred | 未確認 | CWE-428 | Mediconta 3.7.27 contains an unquoted service path vulnerability in the servermedicontservice that allows local users to potentially execute code with elevated privileges. Attacker |
| CVE-2023-54337 | Modified | 未確認 | CWE-1284 | Sysax Multi Server 6.95 contains a denial of service vulnerability in the administrative password field that allows attackers to crash the application. Attackers can overwrite the |
| CVE-2023-54338 | Deferred | 未確認 | CWE-428 | Tftpd32 SE 4.60 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit th |
| CVE-2023-54339 | Analyzed | 未確認 | CWE-78 | Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can ex |
| CVE-2023-54340 | Deferred | 未確認 | CWE-89 | WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password parameters. Attackers can inj |
| CVE-2023-54341 | Analyzed | 未確認 | CWE-79 | Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.ph |
| CVE-2023-7333 | Deferred | 未確認 | CWE-74, CWE-89 | A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This manipulation causes |
| CVE-2023-7334 | Analyzed | 未確認 | CWE-502 | Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can s |
| CVE-2023-7335 | Deferred | 未確認 | CWE-22 | EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the classroom-course-statistics export functionality. A remote, unauthenticated attacker can supply |
| CVE-2024-11976 | Deferred | 未確認 | CWE-94 | The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to e |
| CVE-2024-14020 | Deferred | 未確認 | CWE-1321, CWE-94 | A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Forma |
| CVE-2024-14021 | Analyzed | 未確認 | CWE-502 | LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed |
| CVE-2024-22166 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-23511 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows DOM-Bas |
| CVE-2024-30461 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based XSS.This issue affec |
| CVE-2024-30516 | Deferred | 未確認 | CWE-1284 | Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects B |
| CVE-2024-30547 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider allows DOM-Based XSS.Th |
| CVE-2024-31088 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSense Ads allows DOM-Bas |
| CVE-2024-36988 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-36998 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-4027 | Deferred | 未確認 | CWE-20 | A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large |
| CVE-2024-44210 | Analyzed | 未確認 | CWE-284 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
| CVE-2024-44238 | Modified | 未確認 | CWE-119 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An app may be able to corrupt coprocessor memory. |
| CVE-2024-45724 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45725 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45726 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45727 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45728 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45729 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45730 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45742 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-45743 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-48077 | Modified | 未確認 | CWE-400, CWE-833 | NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rapi |
| CVE-2024-53248 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-53249 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-53250 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-53251 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-53252 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
| CVE-2024-53735 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in corourke iPhone Webclip Manager iphone-webclip-manager allows Stored XSS.This |
| CVE-2024-54556 | Analyzed | 未確認 | CWE-284 | This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from the lock screen. |
| CVE-2024-54855 | Modified | 未確認 | CWE-321 | fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during c |
| CVE-2024-55374 | Modified | 未確認 | CWE-203 | REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts. |
| CVE-2024-56809 | Rejected | 未確認 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2024. Notes: none | |
| CVE-2024-56825 | Rejected | 未確認 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2024. Notes: none | |
| CVE-2024-58339 | Analyzed | 未確認 | CWE-770 | LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. |
| CVE-2024-58340 | Analyzed | 未確認 | CWE-1333 | LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/a |
| CVE-2024-8491 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2024-8506 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2024-9432 | Deferred | 未確認 | CWE-312 | Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data. The vulnerability could read Vertica agent plaintext apike |
| CVE-2025-0647 | Analyzed | 未確認 | CWE-226 | In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another P |
| CVE-2025-0980 | Deferred | 未確認 | CWE-284 | Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access |
| CVE-2025-10024 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection. This issue |
| CVE-2025-10484 | Deferred | 未確認 | CWE-288 | The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is d |
| CVE-2025-10569 | Analyzed | 未確認 | CWE-770 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated us |
| CVE-2025-10855 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trusted Identifiers. This issue affects Tekn |
| CVE-2025-10856 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through |
| CVE-2025-10865 | Analyzed | 未確認 | CWE-416 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Imprope |
| CVE-2025-10915 | Deferred | 未確認 | The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check. | |
| CVE-2025-10933 | Deferred | 未確認 | CWE-125, CWE-1284, CWE-191 | An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads. |
| CVE-2025-11002 | Analyzed | 未確認 | CWE-22 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7- |
| CVE-2025-11043 | Deferred | 未確認 | CWE-295 | An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker |
| CVE-2025-11044 | Deferred | 未確認 | CWE-770 | An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to R4.93 could be explo |
| CVE-2025-11065 | Deferred | 未確認 | CWE-209 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through d |
| CVE-2025-11157 | Deferred | 未確認 | CWE-502 | A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/inf |
| CVE-2025-11175 | Deferred | 未確認 | CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - Discuss |
| CVE-2025-11187 | Modified | 未確認 | CWE-476, CWE-787 | Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC ver |
| CVE-2025-11224 | Analyzed | 未確認 | CWE-79 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated |
| CVE-2025-11235 | Analyzed | 未確認 | CWE-620 | Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 |
| CVE-2025-11246 | Analyzed | 未確認 | CWE-1220 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated u |
| CVE-2025-11250 | Analyzed | 未確認 | CWE-290 | Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations. |
| CVE-2025-11370 | Deferred | 未確認 | CWE-862 | The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulner |
| CVE-2025-11453 | Deferred | 未確認 | CWE-79 | The Header and Footer Scripts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _inpost_head_script parameter in all versions up to, and including, 2.3.0 du |
| CVE-2025-11468 | Deferred | 未確認 | CWE-93 | When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into e |
| CVE-2025-11669 | Analyzed | 未確認 | CWE-862 | Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue i |
| CVE-2025-11687 | Deferred | 未確認 | CWE-79 | A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client- |
| CVE-2025-11723 | Deferred | 未確認 | CWE-330 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu |
| CVE-2025-11743 | Deferred | 未確認 | CWE-1284 | A denial-of-service security issue in the affected product. The security issue occurs when a malformed CIP forward open message is sent. This could result in a major nonrecoverable |
| CVE-2025-11837 | Analyzed | 未確認 | CWE-94 | An improper control of generation of code vulnerability has been reported to affect Malware Remover. The remote attackers can then exploit the vulnerability to bypass protection me |
| CVE-2025-11877 | Deferred | 未確認 | CWE-862 | The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capabilit |
| CVE-2025-12002 | Deferred | 未確認 | CWE-22 | The Feeds for YouTube Pro plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.6.0 via the 'sby_check_wp_submit' AJAX action. This is d |
| CVE-2025-12006 | Deferred | 未確認 | CWE-347 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW-F . An attacker can update the system firmware with a specially crafted image. |
| CVE-2025-12007 | Deferred | 未確認 | CWE-347 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image. |
| CVE-2025-12030 | Deferred | 未確認 | CWE-639 | The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability check |
| CVE-2025-12050 | Deferred | 未確認 | CWE-787 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow. |
| CVE-2025-12051 | Deferred | 未確認 | CWE-787 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow. |
| CVE-2025-12052 | Deferred | 未確認 | CWE-787 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow. |
| CVE-2025-12053 | Deferred | 未確認 | CWE-787 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow. |
| CVE-2025-12067 | Deferred | 未確認 | CWE-79 | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and including, 1.3.30 due |
| CVE-2025-12129 | Deferred | 未確認 | CWE-200 | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/q |
| CVE-2025-12166 | Deferred | 未確認 | CWE-89 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` para |
| CVE-2025-12168 | Deferred | 未確認 | CWE-862 | The Phrase TMS Integration for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_delete_log' AJAX |
| CVE-2025-12178 | Deferred | 未確認 | CWE-79 | The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' shortcode in all versions up to, and including, 1.0 due to insuff |
| CVE-2025-12379 | Deferred | 未確認 | CWE-79 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a combination of the 'tag' and ‘title_tag’ parameters in all |
| CVE-2025-12386 | Deferred | 未確認 | CWE-306 | Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cl |
| CVE-2025-12387 | Deferred | 未確認 | CWE-754 | A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service (DoS) by sending a specially crafted HTTP POST request cont |
| CVE-2025-12420 | Analyzed | 未確認 | CWE-250 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the imperson |
| CVE-2025-12449 | Deferred | 未確認 | CWE-862 | The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability c |
| CVE-2025-12511 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows |
| CVE-2025-12513 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Sto |
| CVE-2025-12519 | Analyzed | 未確認 | CWE-862 | Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, r |
| CVE-2025-12533 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2025-12540 | Deferred | 未確認 | CWE-200 | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Go |
| CVE-2025-12543 | Modified | 未確認 | CWE-20 | A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header |
| CVE-2025-12548 | Deferred | 未確認 | CWE-306 | A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from |
| CVE-2025-12549 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allows PHP Local File Inc |
| CVE-2025-12550 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows PHP Local File Inclusi |
| CVE-2025-12551 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This issue affects Listin |
| CVE-2025-12573 | Deferred | 未確認 | The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress p | |
| CVE-2025-12640 | Deferred | 未確認 | CWE-862 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all v |
| CVE-2025-12641 | Deferred | 未確認 | CWE-862 | The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including, |
| CVE-2025-12648 | Deferred | 未確認 | CWE-552 | The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in pr |
| CVE-2025-12685 | Deferred | 未確認 | The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer through a CSRF attack. | |
| CVE-2025-12709 | Deferred | 未確認 | CWE-79 | The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event selectors in all versions up to, a |
| CVE-2025-12718 | Deferred | 未確認 | CWE-20 | The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allow |
| CVE-2025-12738 | Deferred | 未確認 | CWE-200 | Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. |
| CVE-2025-12776 | Analyzed | 未確認 | CWE-79 | The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting |
| CVE-2025-12780 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2025-12781 | Analyzed | 未確認 | CWE-704 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the |
| CVE-2025-12793 | Analyzed | 未確認 | CWE-426 | An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location |
| CVE-2025-12810 | Analyzed | 未確認 | CWE-287 | Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A se |
| CVE-2025-12825 | Deferred | 未確認 | CWE-862 | The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_form_data' function i |
| CVE-2025-12836 | Deferred | 未確認 | CWE-79 | The VK Google Job Posting Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Description field in versions up to, and including, 1.2.23 due to in |
| CVE-2025-12895 | Deferred | 未確認 | CWE-862 | The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_for |
| CVE-2025-12899 | Deferred | 未確認 | CWE-843 | A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and crea |
| CVE-2025-12957 | Deferred | 未確認 | CWE-434 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validati |
| CVE-2025-12958 | Deferred | 未確認 | CWE-285 | The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page |
| CVE-2025-12984 | Deferred | 未確認 | CWE-89 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 2.0.15 due to insufficie |
| CVE-2025-12985 | Deferred | 未確認 | CWE-732 | IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator ima |
| CVE-2025-13034 | Modified | 未確認 | CWE-295 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to verify the peer. Thi |
| CVE-2025-13056 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration module |
| CVE-2025-13062 | Deferred | 未確認 | CWE-434 | The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.5.62. This is due to insufficient file type validation |
| CVE-2025-13139 | Deferred | 未確認 | CWE-352 | The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missin |
| CVE-2025-13151 | Analyzed | 未確認 | CWE-787 | Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. |
| CVE-2025-13153 | Deferred | 未確認 | The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with th | |
| CVE-2025-13154 | Deferred | 未確認 | CWE-59 | An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file dele |
| CVE-2025-13175 | Deferred | 未確認 | CWE-549 | Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to reveal the value using browser developer/inspection tools. The |
| CVE-2025-13176 | Deferred | 未確認 | CWE-269 | Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL. |
| CVE-2025-13194 | Deferred | 未確認 | CWE-352 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all |
| CVE-2025-13205 | Deferred | 未確認 | CWE-352 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all |
| CVE-2025-13215 | Deferred | 未確認 | CWE-200 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via the auxels_ajax_searc |
| CVE-2025-13335 | Analyzed | 未確認 | CWE-835 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that under certain circumstances could hav |
| CVE-2025-13369 | Deferred | 未確認 | CWE-79 | The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', an |
| CVE-2025-13371 | Deferred | 未確認 | CWE-200 | The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This is due to the plugin storing full payment car |
| CVE-2025-13374 | Deferred | 未確認 | CWE-434 | The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, an |
| CVE-2025-13393 | Deferred | 未確認 | CWE-918 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient valida |
| CVE-2025-13399 | Analyzed | 未確認 | CWE-331 | A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successfu |
| CVE-2025-13409 | Deferred | 未確認 | CWE-89 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions up to, and including, 1.4.13 due to insuf |
| CVE-2025-13418 | Deferred | 未確認 | CWE-79 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and including, 5.1.12 due to in |
| CVE-2025-13419 | Deferred | 未確認 | CWE-862 | The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check |
| CVE-2025-13444 | Analyzed | 未確認 | CWE-78 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary |
| CVE-2025-13447 | Analyzed | 未確認 | CWE-78 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary |
| CVE-2025-13453 | Analyzed | 未確認 | CWE-311 | A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive. |
| CVE-2025-13454 | Analyzed | 未確認 | CWE-319 | A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information. |
| CVE-2025-13455 | Analyzed | 未確認 | CWE-290 | A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted finge |
| CVE-2025-13456 | Deferred | 未確認 | The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which cou | |
| CVE-2025-13457 | Deferred | 未確認 | CWE-639 | The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to m |
| CVE-2025-13465 | Modified | 未確認 | CWE-1321 | The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. Th |
| CVE-2025-13471 | Deferred | 未確認 | The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for e | |
| CVE-2025-13493 | Deferred | 未確認 | CWE-862 | The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and |
| CVE-2025-13496 | Deferred | 未確認 | CWE-862 | The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the moosend_landings_auth_get function in all |
| CVE-2025-13497 | Deferred | 未確認 | CWE-79 | The Recras WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'recrasname' shortcode attribute in all versions up to, and including, 6.4.1. This is |
| CVE-2025-13504 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affe |
| CVE-2025-13519 | Deferred | 未確認 | CWE-352 | The SVG Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validatio |
| CVE-2025-13520 | Deferred | 未確認 | CWE-352 | The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce vali |
| CVE-2025-13521 | Deferred | 未確認 | CWE-352 | The WP Status Notifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validat |
| CVE-2025-13527 | Deferred | 未確認 | CWE-352 | The xShare plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the 'xshare_plug |
| CVE-2025-13529 | Deferred | 未確認 | CWE-862 | The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'init' action in all versions up to, and including, 3.4.9 |
| CVE-2025-13531 | Deferred | 未確認 | CWE-79 | The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to i |
| CVE-2025-13627 | Deferred | 未確認 | CWE-79 | The Makesweat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'makesweat_clubid' setting in all versions up to, and including, 0.1 due to insufficient inp |
| CVE-2025-13628 | Deferred | 未確認 | CWE-862 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the ' |
| CVE-2025-13652 | Deferred | 未確認 | CWE-89 | The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.0.4 due to insufficient |
| CVE-2025-13657 | Deferred | 未確認 | CWE-352 | The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing or incorrect nonce va |
| CVE-2025-13667 | Deferred | 未確認 | CWE-79 | The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up to, and including, 1.0.0 due to insuffi |
| CVE-2025-13676 | Deferred | 未確認 | CWE-79 | The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1. This is due to insufficient input sanitiz |
| CVE-2025-13679 | Deferred | 未確認 | CWE-862 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() fu |
| CVE-2025-13694 | Deferred | 未確認 | CWE-348 | The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user-supplied headers suc |
| CVE-2025-13701 | Deferred | 未確認 | CWE-79 | The Shabat Keeper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] parameter in all versions up to, and including, 0.4.4 due to ins |
| CVE-2025-13704 | Deferred | 未確認 | CWE-79 | The Autogen Headers Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head_class' parameter of the 'autogen_menu' shortcode in all versions up to, and |
| CVE-2025-13717 | Deferred | 未確認 | CWE-862 | The Contact Form vCard Generator plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_gvccf_check_download_request' functi |
| CVE-2025-13722 | Deferred | 未確認 | CWE-862 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and in |
| CVE-2025-13725 | Deferred | 未確認 | CWE-22 | The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 1.0 |
| CVE-2025-13729 | Deferred | 未確認 | CWE-79 | The Entry Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'entry-views' shortcode in all versions up to, and including, 1.0.0 due to insuff |
| CVE-2025-13744 | Analyzed | 未確認 | CWE-79 | An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML to be rendered by the |
| CVE-2025-13746 | Deferred | 未確認 | CWE-79 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due |
| CVE-2025-13749 | Deferred | 未確認 | CWE-352 | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin |
| CVE-2025-13753 | Deferred | 未確認 | CWE-863 | The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the save_table() |
| CVE-2025-13761 | Modified | 未確認 | CWE-79 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arb |
| CVE-2025-13766 | Deferred | 未確認 | CWE-862 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capabi |
| CVE-2025-13772 | Modified | 未確認 | CWE-862 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user |
| CVE-2025-13774 | Analyzed | 未確認 | CWE-89 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries |
| CVE-2025-13781 | Analyzed | 未確認 | CWE-862 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user |
| CVE-2025-13801 | Deferred | 未確認 | CWE-22 | The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possible for unauthenticate |
| CVE-2025-13812 | Deferred | 未確認 | CWE-862 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing c |
| CVE-2025-13820 | Deferred | 未確認 | The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing | |
| CVE-2025-13841 | Deferred | 未確認 | CWE-79 | The Smart App Banners plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' and 'verticalalign' parameters of the 'app-store-download' shortcode in all v |
| CVE-2025-13844 | Analyzed | 未確認 | CWE-415 | CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody. |
| CVE-2025-13845 | Analyzed | 未確認 | CWE-416 | CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody. |
| CVE-2025-13847 | Deferred | 未確認 | CWE-79 | The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to insufficient input sanit |
| CVE-2025-13848 | Deferred | 未確認 | CWE-79 | The STM Gallery 1.9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'composicion' parameter in all versions up to, and including, 0.9 due to insufficient |
| CVE-2025-13849 | Deferred | 未確認 | CWE-79 | The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due to insufficient input |
| CVE-2025-13852 | Deferred | 未確認 | CWE-79 | The Debt.com Business in a Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configuration' parameter of the lead_form shortcode in all versions up to, |
| CVE-2025-13853 | Deferred | 未確認 | CWE-79 | The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions up to, and including |
| CVE-2025-13854 | Deferred | 未確認 | CWE-79 | The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in all versions up to, and including, 0.1 due |
| CVE-2025-13859 | Deferred | 未確認 | CWE-862 | The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_customization_setting |
| CVE-2025-13862 | Deferred | 未確認 | CWE-79 | The Menu Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `category` parameter in all versions up to, and including, 0.8.0 due to insufficient input s |
| CVE-2025-13878 | Deferred | 未確認 | CWE-1286, CWE-617 | Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.1 |
| CVE-2025-13887 | Deferred | 未確認 | CWE-79 | The AI BotKit – AI Chatbot & Live Support for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the `ai_botkit_widget` shortcode |
| CVE-2025-13892 | Deferred | 未確認 | CWE-79 | The MG AdvancedOptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.2 due to |
| CVE-2025-13893 | Deferred | 未確認 | CWE-79 | The Lesson Plan Book plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.3 due to i |
| CVE-2025-13895 | Deferred | 未確認 | CWE-79 | The Top Position Google Finance plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 0 |
| CVE-2025-13897 | Deferred | 未確認 | CWE-79 | The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aft_testimonial_meta_name' custom field in the Client Information metabox i |
| CVE-2025-13900 | Deferred | 未確認 | CWE-79 | The WP Popup Magic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the [wppum_end] shortcode in all versions up to, and including, 1.0 |
| CVE-2025-13903 | Deferred | 未確認 | CWE-79 | The PullQuote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pullquote' shortcode in all versions up to, and including, 1.0 due to insufficient |
| CVE-2025-13905 | Deferred | 未確認 | CWE-276 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modif |
| CVE-2025-13908 | Deferred | 未確認 | CWE-79 | The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortcode in all versions up to, and including, 1.0.2 due to insuff |
| CVE-2025-13917 | Deferred | 未確認 | CWE-269 | WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software applica |
| CVE-2025-13918 | Deferred | 未確認 | CWE-269 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue where |
| CVE-2025-13919 | Deferred | 未確認 | CWE-427 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an att |
| CVE-2025-13920 | Deferred | 未確認 | CWE-200 | The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This m |
| CVE-2025-13921 | Deferred | 未確認 | CWE-862 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capab |
| CVE-2025-13925 | Analyzed | 未確認 | CWE-532 | IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user. |
| CVE-2025-13927 | Analyzed | 未確認 | CWE-770 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated |
| CVE-2025-13928 | Analyzed | 未確認 | CWE-863 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated |
| CVE-2025-13934 | Deferred | 未確認 | CWE-862 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due t |
| CVE-2025-13935 | Deferred | 未確認 | CWE-862 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due t |
| CVE-2025-1395 | Deferred | 未確認 | CWE-209 | Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for application mapping. |
| CVE-2025-13952 | Analyzed | 未確認 | CWE-416 | A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. |
| CVE-2025-13964 | Deferred | 未確認 | CWE-862 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp_ajax function in all |
| CVE-2025-13967 | Deferred | 未確認 | CWE-79 | The Woodpecker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_name' parameter of the [woodpecker-connector] shortcode in all versions |
| CVE-2025-13974 | Deferred | 未確認 | CWE-79 | The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to |
| CVE-2025-13979 | Analyzed | 未確認 | CWE-267, CWE-79 | Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2. |
| CVE-2025-13980 | Analyzed | 未確認 | CWE-288 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Featu |
| CVE-2025-13981 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This iss |
| CVE-2025-13982 | Analyzed | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0. |
| CVE-2025-13983 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: fro |
| CVE-2025-13984 | Analyzed | 未確認 | CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4 |
| CVE-2025-13985 | Analyzed | 未確認 | CWE-863 | Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. |
| CVE-2025-13986 | Analyzed | 未確認 | CWE-288 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 be |
| CVE-2025-13990 | Deferred | 未確認 | CWE-352 | The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on |
| CVE-2025-14001 | Deferred | 未確認 | CWE-862 | The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandle |
| CVE-2025-14017 | Modified | 未確認 | CWE-567 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affe |
| CVE-2025-14025 | Deferred | 未確認 | CWE-279 | A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this v |
| CVE-2025-14026 | Analyzed | 未確認 | Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a fore | |
| CVE-2025-14027 | Deferred | 未確認 | CWE-401 | Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, including malformed Class 3 messages, memory |
| CVE-2025-14028 | Deferred | 未確認 | CWE-79 | The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input |
| CVE-2025-14029 | Deferred | 未確認 | CWE-862 | The Community Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_admin_event_approval() function in all ve |
| CVE-2025-14034 | Deferred | 未確認 | CWE-862 | The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'delete_single_ |
| CVE-2025-14039 | Deferred | 未確認 | CWE-79 | The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta fields in all version |
| CVE-2025-14047 | Deferred | 未確認 | CWE-862 | The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized |
| CVE-2025-14053 | Deferred | 未確認 | CWE-79 | The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to insufficient input sani |
| CVE-2025-14057 | Deferred | 未確認 | CWE-79 | The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 17.0.39 due to insufficient inpu |
| CVE-2025-14058 | Deferred | 未確認 | CWE-306 | A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if |
| CVE-2025-14059 | Deferred | 未確認 | CWE-73 | The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the |
| CVE-2025-14063 | Deferred | 未確認 | CWE-79 | The SEO Links Interlinking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_error' parameter in all versions up to, and including, 1.7.9.9.1 due |
| CVE-2025-14069 | Deferred | 未確認 | CWE-79 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, |
| CVE-2025-14070 | Deferred | 未確認 | CWE-862 | The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'send_test_email' AJAX action in all versions up to, |
| CVE-2025-14072 | Analyzed | 未確認 | The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions. | |
| CVE-2025-14075 | Deferred | 未確認 | CWE-200 | The WP Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.7. This is due to the plugin exposing the 'hotel |
| CVE-2025-14077 | Deferred | 未確認 | CWE-352 | The Simcast plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on th |
| CVE-2025-14078 | Deferred | 未確認 | CWE-862 | The PAYGENT for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.6. This is due to missing authorization checks on |
| CVE-2025-14083 | Deferred | 未確認 | CWE-284 | A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation |
| CVE-2025-14109 | Deferred | 未確認 | CWE-79 | The AH Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column' shortcode attribute in all versions up to, and including, 1.0.2 due to insuffic |
| CVE-2025-14110 | Deferred | 未確認 | CWE-79 | The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.21 due |
| CVE-2025-14112 | Deferred | 未確認 | CWE-79 | The Snillrik Restaurant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'menu_style' shortcode attribute in all versions up to, and including, 2.3.0 due t |
| CVE-2025-14113 | Deferred | 未確認 | CWE-79 | The Viitor Button Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' shortcode attribute in all versions up to, and including, 3.0.0 due to |
| CVE-2025-14114 | Deferred | 未確認 | CWE-79 | The 1180px Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.1.1 due to insuf |
| CVE-2025-14115 | Deferred | 未確認 | CWE-798 | IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direct for UNIX contains h |
| CVE-2025-14118 | Deferred | 未確認 | CWE-79 | The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 due to insufficient in |
| CVE-2025-14120 | Deferred | 未確認 | CWE-79 | The URL Image Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.7 due to insufficient saniti |
| CVE-2025-14121 | Deferred | 未確認 | CWE-79 | The EDD Download Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'edd_download_info_link' shortcode in all versions up to, and including, 1.1 due to |
| CVE-2025-14122 | Deferred | 未確認 | CWE-79 | The AD Sliding FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliding_faq' shortcode in all versions up to, and including, 2.4 due to insufficient i |
| CVE-2025-14124 | Deferred | 未確認 | The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, | |
| CVE-2025-14127 | Deferred | 未確認 | CWE-79 | The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 0.2.1 due |
| CVE-2025-14128 | Deferred | 未確認 | CWE-79 | The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.1.1 |
| CVE-2025-14130 | Deferred | 未確認 | CWE-79 | The Post Like Dislike plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0 due to |
| CVE-2025-14131 | Deferred | 未確認 | CWE-79 | The WP Widget Changer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.2.5 due t |
| CVE-2025-14144 | Deferred | 未確認 | CWE-79 | The Mstoic Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'start' parameter of the ms_youtube_embeds shortcode in all versions up to, and incl |
| CVE-2025-14145 | Deferred | 未確認 | CWE-79 | The Niche Hero | Beautifully-designed blocks in seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spacing' parameter of the nh_row shortcode in all |
| CVE-2025-14146 | Deferred | 未確認 | CWE-862 | The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action |
| CVE-2025-14147 | Deferred | 未確認 | CWE-79 | The Easy GitHub Gist Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the gist shortcode in all versions up to, and including, |
| CVE-2025-14153 | Deferred | 未確認 | CWE-89 | The Page Expire Popup/Redirection for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' shortcode attribute in all versions up to, and including |
| CVE-2025-14172 | Deferred | 未確認 | CWE-862 | The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks |
| CVE-2025-14173 | Deferred | 未確認 | CWE-862 | The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. This is due to missing authorization checks on the ` |
| CVE-2025-14231 | Analyzed | 未確認 | CWE-787 | Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affect |
| CVE-2025-14232 | Analyzed | 未確認 | CWE-787 | Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affecte |
| CVE-2025-14233 | Analyzed | 未確認 | CWE-763 | Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affecte |
| CVE-2025-14234 | Analyzed | 未確認 | CWE-787 | Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected prod |
| CVE-2025-14235 | Analyzed | 未確認 | CWE-787 | Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affe |
| CVE-2025-14236 | Analyzed | 未確認 | CWE-787 | Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected produc |
| CVE-2025-14237 | Analyzed | 未確認 | CWE-787 | Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected |
| CVE-2025-14242 | Deferred | 未確認 | CWE-190 | A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated at |
| CVE-2025-14275 | Deferred | 未確認 | CWE-79 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization in the co |
| CVE-2025-14279 | Analyzed | 未確認 | CWE-346 | MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows mal |
| CVE-2025-14283 | Deferred | 未確認 | CWE-79 | The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting v |
| CVE-2025-14295 | Deferred | 未確認 | CWE-257 | Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE |
| CVE-2025-14301 | Deferred | 未確認 | CWE-22 | The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the `process_table_bulk_a |
| CVE-2025-14316 | Deferred | 未確認 | The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scrip | |
| CVE-2025-14317 | Deferred | 未確認 | CWE-359 | In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify |
| CVE-2025-14338 | Deferred | 未確認 | CWE-284 | Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as in CVE-2025-66005. |
| CVE-2025-14346 | Deferred | 未確認 | CWE-306 | WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue mo |
| CVE-2025-14348 | Deferred | 未確認 | CWE-285 | The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all version |
| CVE-2025-14351 | Deferred | 未確認 | CWE-862 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google_Fonts_Compatibility' |
| CVE-2025-14352 | Deferred | 未確認 | CWE-863 | The Awesome Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to incorrect authorization in the room-single.php shortcode handler in all ver |
| CVE-2025-14358 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: fro |
| CVE-2025-14359 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion. Thi |
| CVE-2025-14360 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2. |
| CVE-2025-14369 | Deferred | 未確認 | dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calcula | |
| CVE-2025-14370 | Deferred | 未確認 | CWE-862 | The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quote |
| CVE-2025-14371 | Deferred | 未確認 | CWE-862 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the |
| CVE-2025-14375 | Deferred | 未確認 | CWE-79 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in al |
| CVE-2025-14376 | Deferred | 未確認 | CWE-922 | A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This c |
| CVE-2025-14377 | Deferred | 未確認 | CWE-312 | A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a playbook is running. This |
| CVE-2025-14379 | Deferred | 未確認 | CWE-79 | The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 1.6 due to insufficient input sanitization and output escap |
| CVE-2025-14384 | Deferred | 未確認 | CWE-862 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability chec |
| CVE-2025-14386 | Deferred | 未確認 | CWE-862 | The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capa |
| CVE-2025-14389 | Deferred | 未確認 | CWE-352 | The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This mak |
| CVE-2025-14428 | Deferred | 未確認 | CWE-862 | The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to |
| CVE-2025-14429 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion |
| CVE-2025-14430 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This |
| CVE-2025-14431 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.Thi |
| CVE-2025-14435 | Analyzed | 未確認 | CWE-770 | Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-l |
| CVE-2025-14436 | Deferred | 未確認 | CWE-79 | The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_connection_id’ parameter in all versions up to, and including, 4.0.49 due |
| CVE-2025-14438 | Deferred | 未確認 | CWE-918 | The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' funct |
| CVE-2025-14441 | Deferred | 未確認 | CWE-862 | The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoint in all versions up |
| CVE-2025-14448 | Analyzed | 未確認 | CWE-79 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile fields in all versions |
| CVE-2025-14450 | Deferred | 未確認 | CWE-862 | The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'change_wallet_fund_request_statu |
| CVE-2025-14453 | Deferred | 未確認 | CWE-79 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style_css' shortcode attribute in all versions up to, and including, 1.0.4 due to in |
| CVE-2025-14457 | Analyzed | 未確認 | CWE-862 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership check in the dnd_codedr |
| CVE-2025-14459 | Deferred | 未確認 | CWE-639 | A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in u |
| CVE-2025-14460 | Deferred | 未確認 | CWE-862 | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modification in all versions up to, and including, 3.1.4. This is due t |
| CVE-2025-14463 | Deferred | 未確認 | CWE-862 | The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a |
| CVE-2025-14464 | Deferred | 未確認 | CWE-200 | The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0. This is due to the plugin registering an AJAX |
| CVE-2025-14465 | Deferred | 未確認 | CWE-352 | The Sticky Action Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce vali |
| CVE-2025-14468 | Deferred | 未確認 | CWE-352 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce ve |
| CVE-2025-14470 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been remov | |
| CVE-2025-14472 | Analyzed | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from |
| CVE-2025-14478 | Deferred | 未確認 | CWE-611 | The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. |
| CVE-2025-14482 | Deferred | 未確認 | CWE-862 | The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on mult |
| CVE-2025-14502 | Deferred | 未確認 | CWE-98 | The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it pos |
| CVE-2025-14505 | Deferred | 未確認 | CWE-1240 | The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/ |
| CVE-2025-14506 | Deferred | 未確認 | CWE-79 | The ConvertForce Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gutenberg block's `entrance_animation` attribute in all versions up to, and |
| CVE-2025-14507 | Deferred | 未確認 | CWE-200 | The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the RE |
| CVE-2025-14510 | Deferred | 未確認 | CWE-303 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from |
| CVE-2025-14524 | Modified | 未確認 | CWE-522, CWE-601 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl |
| CVE-2025-14525 | Deferred | 未確認 | CWE-770 | A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network int |
| CVE-2025-14533 | Deferred | 未確認 | CWE-269 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' func |
| CVE-2025-14552 | Deferred | 未確認 | CWE-79 | The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including, 1.6.1 due to insuffic |
| CVE-2025-14554 | Deferred | 未確認 | CWE-79 | The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all versions up to, and i |
| CVE-2025-14555 | Deferred | 未確認 | CWE-79 | The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdevart_countdown' shortcode in all versions up to, and |
| CVE-2025-14556 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: |
| CVE-2025-14557 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affec |
| CVE-2025-14559 | Deferred | 未確認 | CWE-840 | A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use |
| CVE-2025-14574 | Deferred | 未確認 | CWE-200 | The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoin |
| CVE-2025-14579 | Deferred | 未確認 | The Quiz Maker WordPress plugin before 6.7.0.89 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site | |
| CVE-2025-14596 | Analyzed | 未確認 | CWE-427 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 2 |
| CVE-2025-14598 | Analyzed | 未確認 | CWE-89 | BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be exec |
| CVE-2025-14599 | Analyzed | 未確認 | CWE-427 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Searc |
| CVE-2025-14605 | Analyzed | 未確認 | CWE-427 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: f |
| CVE-2025-14609 | Deferred | 未確認 | CWE-862 | The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API |
| CVE-2025-14610 | Deferred | 未確認 | CWE-918 | The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the plugin not restricti |
| CVE-2025-14612 | Analyzed | 未確認 | CWE-377 | Insecure Temporary File vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows : Use of Predictable File Names.This issue affects Quartus Prime Pro: from 2 |
| CVE-2025-14613 | Deferred | 未確認 | CWE-918 | The GetContentFromURL plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0. This is due to the plugin using wp_remote_get() i |
| CVE-2025-14614 | Analyzed | 未確認 | CWE-377 | Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Explore for P |
| CVE-2025-14615 | Deferred | 未確認 | CWE-352 | The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is |
| CVE-2025-14616 | Deferred | 未確認 | CWE-352 | The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing nonce |
| CVE-2025-14625 | Modified | 未確認 | CWE-427 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Sh |
| CVE-2025-14626 | Deferred | 未確認 | CWE-79 | The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions u |
| CVE-2025-14627 | Deferred | 未確認 | CWE-918 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to |
| CVE-2025-14629 | Deferred | 未確認 | CWE-862 | The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions up |
| CVE-2025-14630 | Deferred | 未確認 | CWE-352 | The AdminQuickbar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.3. This is due to missing or incorrect nonce validation |
| CVE-2025-14631 | Analyzed | 未確認 | CWE-476 | A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by triggering a device reboot. |
| CVE-2025-14632 | Deferred | 未確認 | CWE-434 | The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due t |
| CVE-2025-14657 | Deferred | 未確認 | CWE-862 | The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch |
| CVE-2025-14718 | Deferred | 未確認 | CWE-862 | The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin |
| CVE-2025-14719 | Deferred | 未確認 | The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowin | |
| CVE-2025-14720 | Deferred | 未確認 | CWE-862 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all |
| CVE-2025-14725 | Deferred | 未確認 | CWE-79 | The Internal Link Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input s |
| CVE-2025-14736 | Deferred | 未確認 | CWE-269 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of |
| CVE-2025-14741 | Deferred | 未確認 | CWE-862 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the |
| CVE-2025-14745 | Deferred | 未確認 | CWE-79 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' s |
| CVE-2025-14750 | Deferred | 未確認 | CWE-472 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters a |
| CVE-2025-14751 | Deferred | 未確認 | CWE-620 | A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation. |
| CVE-2025-14756 | Analyzed | 未確認 | CWE-77 | Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a l |
| CVE-2025-14757 | Analyzed | 未確認 | CWE-862 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination wi |
| CVE-2025-14770 | Deferred | 未確認 | CWE-89 | The Shipping Rate By Cities plugin for WordPress is vulnerable to SQL Injection via the 'city' parameter in all versions up to, and including, 2.0.0 due to insufficient escaping on |
| CVE-2025-14782 | Deferred | 未確認 | CWE-862 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via |
| CVE-2025-14792 | Deferred | 未確認 | CWE-80 | The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in all versions up to, and including, 1.1 du |
| CVE-2025-14793 | Deferred | 未確認 | CWE-918 | The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.0 via the 'addContentToMpdf' functi |
| CVE-2025-14795 | Deferred | 未確認 | CWE-352 | The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing nonce validation in |
| CVE-2025-14796 | Deferred | 未確認 | CWE-79 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image titles in all versions up to, and including, 1.0.4. This is due to insufficient inp |
| CVE-2025-14797 | Deferred | 未確認 | CWE-79 | The Same Category Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title placeholder functionality in all versions up to, and including, 1.1.1 |
| CVE-2025-14798 | Deferred | 未確認 | CWE-862 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_permissions_check fun |
| CVE-2025-14802 | Deferred | 未確認 | CWE-639 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/{file_id} |
| CVE-2025-14803 | Deferred | 未確認 | CWE-79 | The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that co |
| CVE-2025-14804 | Deferred | 未確認 | The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to | |
| CVE-2025-14819 | Modified | 未確認 | CWE-295 | When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memor |
| CVE-2025-14822 | Analyzed | 未確認 | CWE-407, CWE-770 | Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP requ |
| CVE-2025-14829 | Deferred | 未確認 | The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthentic | |
| CVE-2025-14830 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scripting (XSS).This issu |
| CVE-2025-14835 | Deferred | 未確認 | CWE-80 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to i |
| CVE-2025-14840 | Analyzed | 未確認 | CWE-754 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before |
| CVE-2025-14842 | Deferred | 未確認 | CWE-434 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1. |
| CVE-2025-14843 | Deferred | 未確認 | CWE-862 | The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3.1. This is due to a l |
| CVE-2025-14844 | Analyzed | 未確認 | CWE-639 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_ |
| CVE-2025-14845 | Deferred | 未確認 | CWE-352 | The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due to missing nonce vali |
| CVE-2025-14846 | Deferred | 未確認 | CWE-352 | The SocialChamp with WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5. This is due to missing nonce validation |
| CVE-2025-14853 | Deferred | 未確認 | CWE-352 | The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrect nonce validation on |
| CVE-2025-14854 | Deferred | 未確認 | CWE-862 | The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_sta |
| CVE-2025-14865 | Deferred | 未確認 | CWE-79 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortcode in all versions u |
| CVE-2025-14866 | Deferred | 未確認 | CWE-863 | The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on |
| CVE-2025-14867 | Deferred | 未確認 | CWE-22 | The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. This makes it |
| CVE-2025-14875 | Deferred | 未確認 | CWE-79 | The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5. |
| CVE-2025-14880 | Deferred | 未確認 | CWE-862 | The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_return_url function |
| CVE-2025-14883 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-68016. Reason: This candidate is a reservation duplicate of CVE-2025-68016. Notes: All CVE user | |
| CVE-2025-14886 | Deferred | 未確認 | CWE-862 | The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all vers |
| CVE-2025-14887 | Deferred | 未確認 | CWE-79 | The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and inc |
| CVE-2025-14888 | Deferred | 未確認 | CWE-79 | The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insuf |
| CVE-2025-14891 | Deferred | 未確認 | CWE-79 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 |
| CVE-2025-14893 | Deferred | 未確認 | CWE-79 | The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input s |
| CVE-2025-14894 | Analyzed | 未確認 | CWE-434 | Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE throu |
| CVE-2025-14901 | Deferred | 未確認 | CWE-862 | The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all version |
| CVE-2025-14903 | Deferred | 未確認 | CWE-352 | The Simple Crypto Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2. This is due to missing nonce validation on th |
| CVE-2025-14904 | Deferred | 未確認 | CWE-352 | The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on |
| CVE-2025-14906 | Deferred | 未確認 | CWE-352 | The WP Youtube Video Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce verification o |
| CVE-2025-14907 | Deferred | 未確認 | CWE-352 | The Moderate Selected Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing nonce verification on |
| CVE-2025-14911 | Deferred | 未確認 | CWE-120 | User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container. |
| CVE-2025-14937 | Deferred | 未確認 | CWE-79 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action i |
| CVE-2025-14941 | Deferred | 未確認 | CWE-79 | The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This is due to missing cap |
| CVE-2025-14942 | Analyzed | 未確認 | CWE-287 | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping us |
| CVE-2025-14943 | Deferred | 未確認 | CWE-863 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to |
| CVE-2025-14947 | Deferred | 未確認 | CWE-862 | The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_vid |
| CVE-2025-14948 | Deferred | 未確認 | CWE-862 | The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th |
| CVE-2025-14969 | Deferred | 未確認 | CWE-772 | A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may |
| CVE-2025-14971 | Deferred | 未確認 | CWE-862 | The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and c |
| CVE-2025-14973 | Deferred | 未確認 | CWE-89 | The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform S |
| CVE-2025-14975 | Deferred | 未確認 | CWE-269 | The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any u |
| CVE-2025-14976 | Deferred | 未確認 | CWE-352 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable t |
| CVE-2025-14977 | Deferred | 未確認 | CWE-284 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in ver |
| CVE-2025-14978 | Deferred | 未確認 | CWE-862 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data |
| CVE-2025-14979 | Analyzed | 未確認 | CWE-732 | AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6. |
| CVE-2025-14980 | Deferred | 未確認 | CWE-200 | The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. This makes it possible f |
| CVE-2025-14982 | Deferred | 未確認 | CWE-862 | The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This make |
| CVE-2025-14984 | Deferred | 未確認 | CWE-79 | The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's f |
| CVE-2025-14985 | Deferred | 未確認 | CWE-79 | The Alpha Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alpha_block_css’ parameter in all versions up to, and including, 1.5.0 due to insufficie |
| CVE-2025-14988 | Deferred | 未確認 | CWE-732 | A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or |
| CVE-2025-14996 | Deferred | 未確認 | CWE-639 | The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This |
| CVE-2025-14997 | Deferred | 未確認 | CWE-22 | The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in |
| CVE-2025-14998 | Deferred | 未確認 | CWE-639 | The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly vali |
| CVE-2025-14999 | Deferred | 未確認 | CWE-352 | The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on |
| CVE-2025-15000 | Deferred | 未確認 | CWE-79 | The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to insufficient input s |
| CVE-2025-15001 | Deferred | 未確認 | CWE-639 | The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin |
| CVE-2025-15018 | Deferred | 未確認 | CWE-639 | The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restr |
| CVE-2025-15019 | Deferred | 未確認 | CWE-79 | The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bialty_cs_alt' pos |
| CVE-2025-15020 | Deferred | 未確認 | CWE-22 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.5.0 via the 'ghostban' shortcode. This makes it poss |
| CVE-2025-15021 | Deferred | 未確認 | CWE-79 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 due to insufficient in |
| CVE-2025-15022 | Deferred | 未確認 | CWE-79 | Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input. In Vaadin F |
| CVE-2025-15026 | Analyzed | 未確認 | CWE-306 | Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained b |
| CVE-2025-15029 | Analyzed | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauth |
| CVE-2025-15032 | Deferred | 未確認 | CWE-1021 | Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about |
| CVE-2025-15035 | Analyzed | 未確認 | CWE-20 | Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible lo |
| CVE-2025-15043 | Deferred | 未確認 | CWE-862 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migrat |
| CVE-2025-15055 | Deferred | 未確認 | CWE-79 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all versions up to, and including, 5.3.4 due t |
| CVE-2025-15056 | Modified | 未確認 | CWE-79 | A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3. |
| CVE-2025-15057 | Deferred | 未確認 | CWE-79 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and including, 5.3.3. This is d |
| CVE-2025-15058 | Deferred | 未確認 | CWE-80 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and including, 5.1.12 due t |
| CVE-2025-15059 | Modified | 未確認 | CWE-122, CWE-787 | GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations |
| CVE-2025-15061 | Deferred | 未確認 | CWE-78 | Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in |
| CVE-2025-15062 | Deferred | 未確認 | CWE-416 | Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations |
| CVE-2025-15063 | Deferred | 未確認 | CWE-78 | Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of |
| CVE-2025-15079 | Modified | 未確認 | CWE-297 | When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified |
| CVE-2025-15104 | Analyzed | 未確認 | CWE-918 | Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including |
| CVE-2025-15115 | Analyzed | 未確認 | CWE-862 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any user account by exploit |
| CVE-2025-15158 | Deferred | 未確認 | CWE-434 | The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function in all versions up to, |
| CVE-2025-15224 | Modified | 未確認 | CWE-287 | When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. |
| CVE-2025-15235 | Analyzed | 未確認 | CWE-862 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify specific network packet |
| CVE-2025-15236 | Analyzed | 未確認 | CWE-36 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified |
| CVE-2025-15237 | Analyzed | 未確認 | CWE-36 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified |
| CVE-2025-15238 | Analyzed | 未確認 | CWE-89 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read |
| CVE-2025-15239 | Analyzed | 未確認 | CWE-89 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read |
| CVE-2025-15240 | Analyzed | 未確認 | CWE-434 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell |
| CVE-2025-15265 | Analyzed | 未確認 | CWE-79 | An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block without HTML‑safe escaping, allowing </scri |
| CVE-2025-15266 | Deferred | 未確認 | CWE-79 | The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat message field in all v |
| CVE-2025-15281 | Analyzed | 未確認 | CWE-908 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wo |
| CVE-2025-15282 | Deferred | 未確認 | CWE-93 | User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype. |
| CVE-2025-15283 | Deferred | 未確認 | CWE-79 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters in all versions up t |
| CVE-2025-15288 | Analyzed | 未確認 | CWE-863 | Tanium addressed an improper access controls vulnerability in Interact. |
| CVE-2025-15322 | Analyzed | 未確認 | CWE-863 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
| CVE-2025-15344 | Analyzed | 未確認 | CWE-89 | Tanium addressed a SQL injection vulnerability in Asset. |
| CVE-2025-15346 | Deferred | 未確認 | CWE-287, CWE-306 | A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fully enforced. Because |
| CVE-2025-15347 | Deferred | 未確認 | CWE-862 | The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a |
| CVE-2025-15348 | Analyzed | 未確認 | CWE-502 | Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af |
| CVE-2025-15349 | Analyzed | 未確認 | CWE-362 | Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations |
| CVE-2025-15350 | Analyzed | 未確認 | CWE-502 | Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a |
| CVE-2025-15351 | Analyzed | 未確認 | CWE-502 | Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a |
| CVE-2025-15364 | Deferred | 未確認 | CWE-353 | The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not pro |
| CVE-2025-15366 | Deferred | 未確認 | CWE-77 | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. |
| CVE-2025-15367 | Deferred | 未確認 | CWE-77 | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. |
| CVE-2025-15370 | Deferred | 未確認 | CWE-639 | The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, |
| CVE-2025-15376 | Deferred | 未確認 | CWE-352 | The Stopwords for comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on th |
| CVE-2025-15377 | Deferred | 未確認 | CWE-352 | The Sosh Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the |
| CVE-2025-15378 | Deferred | 未確認 | CWE-79 | The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' parameters in all versions up to, and in |
| CVE-2025-15380 | Deferred | 未確認 | CWE-79 | The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable t |
| CVE-2025-15382 | Analyzed | 未確認 | CWE-125 | A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input conta |
| CVE-2025-15385 | Analyzed | 未確認 | CWE-345 | Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.Boomplayer: 7.4.63. |
| CVE-2025-15403 | Deferred | 未確認 | CWE-269 | The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible |
| CVE-2025-15404 | Analyzed | 未確認 | CWE-284, CWE-434 | A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.php. The manipulation |
| CVE-2025-15405 | Analyzed | 未確認 | CWE-352, CWE-862 | A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched r |
| CVE-2025-15406 | Analyzed | 未確認 | CWE-862, CWE-863 | A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Remote exploitation of t |
| CVE-2025-15407 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category.php. Such manipulation of the argument |
| CVE-2025-15408 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. Performing a manipulation of the argument |
| CVE-2025-15409 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Delete_product.php. Executing |
| CVE-2025-15410 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argume |
| CVE-2025-15411 | Modified | 未確認 | CWE-119 | A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the |
| CVE-2025-15412 | Modified | 未確認 | CWE-119, CWE-125 | A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompil |
| CVE-2025-15413 | Modified | 未確認 | CWE-119, CWE-787 | A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function op_SetSlot_i32/op_CallIndirect of the file m3_exec.h. Performing a manipulation results in memory corrup |
| CVE-2025-15414 | Deferred | 未確認 | CWE-918 | A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.go of the component Theme Fetching API. E |
| CVE-2025-15415 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component XML File Handler. Th |
| CVE-2025-15416 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Handler. The manipulation |
| CVE-2025-15417 | Modified | 未確認 | CWE-404 | A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of the component GTPv2-C F |
| CVE-2025-15418 | Modified | 未確認 | CWE-404 | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the compon |
| CVE-2025-15419 | Modified | 未確認 | CWE-404 | A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the comp |
| CVE-2025-15420 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads |
| CVE-2025-15421 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The |
| CVE-2025-15422 | Analyzed | 未確認 | CWE-693 | A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. This manipulati |
| CVE-2025-15423 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipulation leads to unrestr |
| CVE-2025-15424 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. Per |
| CVE-2025-15425 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Exec |
| CVE-2025-15426 | Deferred | 未確認 | CWE-284, CWE-434 | A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The manipulation leads t |
| CVE-2025-15427 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a se | |
| CVE-2025-15428 | Analyzed | 未確認 | CWE-119, CWE-120 | A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This manipulation of the argument Profile causes |
| CVE-2025-15429 | Analyzed | 未確認 | CWE-119, CWE-120 | A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCliForEngineerOnly. Such |
| CVE-2025-15430 | Modified | 未確認 | CWE-119, CWE-120 | A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Performing a manipulation o |
| CVE-2025-15431 | Modified | 未確認 | CWE-119, CWE-120 | A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a manipulation of the argument filename ca |
| CVE-2025-15432 | Modified | 未確認 | CWE-22 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downlo |
| CVE-2025-15434 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results in sql injection. It |
| CVE-2025-15435 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp. This manipulation of the argument Repor |
| CVE-2025-15436 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. Such manipulation of the argument Repo |
| CVE-2025-15437 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUEST |
| CVE-2025-15438 | Analyzed | 未確認 | CWE-20, CWE-502 | A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module |
| CVE-2025-15439 | Deferred | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_aggregate.go of the component Aggregate |
| CVE-2025-15442 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of the argument cate_id ca |
| CVE-2025-15443 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation of the argument cate |
| CVE-2025-15444 | Analyzed | 未確認 | CWE-347 | Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version of libsodium released before December 30, |
| CVE-2025-15446 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a se | |
| CVE-2025-15447 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a se | |
| CVE-2025-15448 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/com/macro/mall/control |
| CVE-2025-15449 | Analyzed | 未確認 | CWE-22 | A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/con |
| CVE-2025-15450 | Deferred | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderHosNum of the file /ss |
| CVE-2025-15451 | Analyzed | 未確認 | CWE-79, CWE-94 | A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.do of the component Sy |
| CVE-2025-15452 | Analyzed | 未確認 | CWE-79, CWE-94 | A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component Backend Variable Sear |
| CVE-2025-15453 | Deferred | 未確認 | CWE-20, CWE-502 | A security vulnerability has been detected in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/expr/expr.go of the component HTTP Endpoint |
| CVE-2025-15454 | Deferred | 未確認 | CWE-79, CWE-94 | A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component |
| CVE-2025-15455 | Analyzed | 未確認 | CWE-287 | A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery Request Handler. This |
| CVE-2025-15456 | Analyzed | 未確認 | CWE-287 | A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Publish Page Handler. S |
| CVE-2025-15457 | Analyzed | 未確認 | CWE-287 | A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Trash File Restore Handle |
| CVE-2025-15458 | Analyzed | 未確認 | CWE-287 | A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handler. Executing a manip |
| CVE-2025-15459 | Analyzed | 未確認 | CWE-119, CWE-120 | A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formUser. Such manipulation of the argumen |
| CVE-2025-15460 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formPptpClientConfig. Performing a manipulation of the argument Encry |
| CVE-2025-15461 | Analyzed | 未確認 | CWE-119, CWE-120 | A flaw has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/formTaskEdit. Executing a manipulation of the argument selDate |
| CVE-2025-15462 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart lea |
| CVE-2025-15464 | Analyzed | 未確認 | CWE-926 | Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls. |
| CVE-2025-15466 | Deferred | 未確認 | CWE-862 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX action |
| CVE-2025-15467 | Modified | 未確認 | CWE-120, CWE-787 | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer |
| CVE-2025-15468 | Analyzed | 未確認 | CWE-476 | Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. |
| CVE-2025-15469 | Analyzed | 未確認 | CWE-347 | Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact su |
| CVE-2025-15471 | Modified | 未確認 | CWE-77, CWE-78 | A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the argument SZCMD results |
| CVE-2025-15472 | Analyzed | 未確認 | CWE-77, CWE-78 | A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument Devi |
| CVE-2025-15474 | Deferred | 未確認 | CWE-770 | AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause |
| CVE-2025-15475 | Deferred | 未確認 | CWE-862 | The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic in the check_payhere_ |
| CVE-2025-15479 | Analyzed | 未確認 | CWE-79 | Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platfo |
| CVE-2025-15486 | Deferred | 未確認 | CWE-79 | The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML con |
| CVE-2025-15492 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/mapping/GroupMemberMapper.xml. Performing a |
| CVE-2025-15493 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/ReposAuthMapper.xml. Executing a manipulat |
| CVE-2025-15494 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipulation of the argument |
| CVE-2025-15495 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unre |
| CVE-2025-15496 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql inje |
| CVE-2025-15497 | Deferred | 未確認 | CWE-617 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service |
| CVE-2025-15499 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function uploadCN of the file VersionController.ja |
| CVE-2025-15500 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-protocol/protocol/getHis |
| CVE-2025-15501 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /isomp-protocol/protocol |
| CVE-2025-15502 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController of the file /isomp-protoco |
| CVE-2025-15503 | Analyzed | 未確認 | CWE-284, CWE-434 | A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file /fort/trust/version/ |
| CVE-2025-15504 | Modified | 未確認 | CWE-404, CWE-476 | A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parse_binary of the file src/ELF/Parser.tcc of the component E |
| CVE-2025-15505 | Deferred | 未確認 | CWE-79, CWE-94 | A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipulation of the argument |
| CVE-2025-15506 | Deferred | 未確認 | CWE-119, CWE-125 | A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression of the file src/OpenColorIO/FileRules.cpp |
| CVE-2025-15510 | Deferred | 未確認 | CWE-862 | The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all |
| CVE-2025-15511 | Deferred | 未確認 | CWE-862 | The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, an |
| CVE-2025-15512 | Deferred | 未確認 | CWE-862 | The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_response() function in all |
| CVE-2025-15513 | Deferred | 未確認 | CWE-863 | The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() function in all versio |
| CVE-2025-15514 | Modified | 未確認 | CWE-395 | Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-en |
| CVE-2025-15516 | Deferred | 未確認 | CWE-862 | The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_store_user_meta() functi |
| CVE-2025-15521 | Deferred | 未確認 | CWE-639 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and in |
| CVE-2025-15522 | Deferred | 未確認 | CWE-79 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord |
| CVE-2025-15523 | Deferred | 未確認 | CWE-276 | MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An |
| CVE-2025-15525 | Deferred | 未確認 | CWE-863 | The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_ar |
| CVE-2025-15526 | Deferred | 未確認 | CWE-209 | The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF |
| CVE-2025-15527 | Deferred | 未確認 | CWE-200 | The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api_get_post_summary function due to insufficient re |
| CVE-2025-15528 | Modified | 未確認 | CWE-404 | A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handler. Such manipulation |
| CVE-2025-15529 | Modified | 未確認 | CWE-404 | A vulnerability was found in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c. Performing a ma |
| CVE-2025-15530 | Modified | 未確認 | CWE-617 | A vulnerability was determined in Open5GS up to 2.7.6. This affects the function sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request of the file /src/sgwc/s11-handler.c. |
| CVE-2025-15531 | Modified | 未確認 | CWE-617 | A vulnerability was identified in Open5GS up to 2.7.5. This vulnerability affects the function sgwc_bearer_add of the file src/sgwc/context.c. The manipulation leads to reachable a |
| CVE-2025-15532 | Modified | 未確認 | CWE-400, CWE-404 | A security flaw has been discovered in Open5GS up to 2.7.5. This issue affects some unknown processing of the component Timer Handler. The manipulation results in resource consumpt |
| CVE-2025-15533 | Modified | 未確認 | CWE-119, CWE-122 | A vulnerability was determined in raysan5 raylib up to 909f040. Affected by this vulnerability is the function GenImageFontAtlas of the file src/rtext.c. Executing a manipulation c |
| CVE-2025-15534 | Modified | 未確認 | CWE-189, CWE-190 | A vulnerability was identified in raysan5 raylib up to 909f040. Affected by this issue is the function LoadFontData of the file src/rtext.c. The manipulation leads to integer overf |
| CVE-2025-15535 | Deferred | 未確認 | CWE-404, CWE-476 | A security flaw has been discovered in nicbarker clay up to 0.14. This affects the function Clay__MeasureTextCached in the library clay.h. The manipulation results in null pointer |
| CVE-2025-15536 | Modified | 未確認 | CWE-119, CWE-122, CWE-787 | A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This man |
| CVE-2025-15537 | Modified | 未確認 | CWE-119, CWE-122, CWE-787 | A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such ma |
| CVE-2025-15538 | Analyzed | 未確認 | CWE-119, CWE-416 | A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. Affected by this vulnerability is the function Assimp::LWOImporter::FindUVChannels of th |
| CVE-2025-15539 | Modified | 未確認 | CWE-404 | A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_downlink_data_notification_ack of the file src/sgwc/s11-handler.c of the component s |
| CVE-2025-15541 | Analyzed | 未確認 | CWE-59 | Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentia |
| CVE-2025-15542 | Analyzed | 未確認 | CWE-754 | Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all voice lines and causi |
| CVE-2025-15543 | Analyzed | 未確認 | CWE-59 | Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only ac |
| CVE-2025-15545 | Analyzed | 未確認 | CWE-20 | The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted |
| CVE-2025-15548 | Analyzed | 未確認 | CWE-311 | Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network adjacent attacker to i |
| CVE-2025-15549 | Modified | 未確認 | CWE-79 | FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via the File Management mo |
| CVE-2025-15550 | Deferred | 未確認 | CWE-352 | birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query requests. Attackers can cr |
| CVE-2025-1719 | Analyzed | 未確認 | CWE-244 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
| CVE-2025-1722 | Analyzed | 未確認 | CWE-244 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
| CVE-2025-20760 | Modified | 未確認 | CWE-617 | In Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base stati |
| CVE-2025-20761 | Modified | 未確認 | CWE-754 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by |
| CVE-2025-20762 | Modified | 未確認 | CWE-617 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by |
| CVE-2025-20778 | Analyzed | 未確認 | CWE-787 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the Sy |
| CVE-2025-20779 | Analyzed | 未確認 | CWE-416 | In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privil |
| CVE-2025-20780 | Analyzed | 未確認 | CWE-416 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privi |
| CVE-2025-20781 | Modified | 未確認 | CWE-415, CWE-416 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privi |
| CVE-2025-20782 | Analyzed | 未確認 | CWE-787 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the Sy |
| CVE-2025-20783 | Analyzed | 未確認 | CWE-787 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the Sy |
| CVE-2025-20784 | Analyzed | 未確認 | CWE-457 | In display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a malicious actor has already obtained the System p |
| CVE-2025-20785 | Analyzed | 未確認 | CWE-416 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privi |
| CVE-2025-20786 | Modified | 未確認 | CWE-415, CWE-416 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privi |
| CVE-2025-20787 | Analyzed | 未確認 | CWE-416 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privi |
| CVE-2025-20793 | Modified | 未確認 | CWE-476 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by |
| CVE-2025-20794 | Modified | 未確認 | CWE-121 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled b |
| CVE-2025-20795 | Analyzed | 未確認 | CWE-787 | In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the |
| CVE-2025-20796 | Analyzed | 未確認 | CWE-1285 | In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the |
| CVE-2025-20797 | Analyzed | 未確認 | CWE-121, CWE-787 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the Sy |
| CVE-2025-20798 | Analyzed | 未確認 | CWE-787 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the Sy |
| CVE-2025-20799 | Analyzed | 未確認 | CWE-416 | In c2ps, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privileg |
| CVE-2025-20800 | Analyzed | 未確認 | CWE-787 | In mminfra, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the Sy |
| CVE-2025-20801 | Modified | 未確認 | CWE-362, CWE-415 | In seninf, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System priv |
| CVE-2025-20802 | Analyzed | 未確認 | CWE-416 | In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System pri |
| CVE-2025-20803 | Analyzed | 未確認 | CWE-190 | In dpe, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System priv |
| CVE-2025-20804 | Analyzed | 未確認 | CWE-416 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege |
| CVE-2025-20805 | Analyzed | 未確認 | CWE-416 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege |
| CVE-2025-20806 | Analyzed | 未確認 | CWE-416 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege |
| CVE-2025-20807 | Analyzed | 未確認 | CWE-190 | In dpe, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System pr |
| CVE-2025-21589 | Deferred | 未確認 | CWE-288 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and |
| CVE-2025-2204 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tapandsign Technologies Software Inc. Tap&Sign allows Cross-Site Script |
| CVE-2025-22154 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22155 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22180 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22181 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22182 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22183 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22184 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22185 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22186 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22187 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22188 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22189 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22190 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22191 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22192 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22193 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22194 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22195 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22196 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22197 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22198 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22199 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22200 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22201 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22202 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22203 | Rejected | 未確認 | Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. | |
| CVE-2025-22234 | Deferred | 未確認 | CWE-208 | The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or ot |
| CVE-2025-22509 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMRW-studio Atlas atlas allows PHP Local File Inclusion.Thi |
| CVE-2025-22707 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.Th |
| CVE-2025-22708 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.Thi |
| CVE-2025-22712 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion. |
| CVE-2025-22713 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows |
| CVE-2025-22715 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting Incorrectly Configured |
| CVE-2025-22725 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Stored XSS.This issue affe |
| CVE-2025-22726 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in _nK nK Themes Helper nk-themes-helper allows Server Side Request Forgery.This issue affects nK Themes Helper: from n/a through < |
| CVE-2025-22728 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue |
| CVE-2025-23504 | Deferred | 未確認 | CWE-288 | Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: |
| CVE-2025-23993 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affe |
| CVE-2025-24089 | Analyzed | 未確認 | CWE-200 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps. |
| CVE-2025-24090 | Analyzed | 未確認 | CWE-200, CWE-284 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps. |
| CVE-2025-24293 | Deferred | 未確認 | CWE-77, CWE-88, CWE-94 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters |
| CVE-2025-24528 | Deferred | 未確認 | CWE-190 | In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker ca |
| CVE-2025-24531 | Deferred | 未確認 | CWE-393 | In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing aut |
| CVE-2025-25051 | Deferred | 未確認 | CWE-256 | An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks. |
| CVE-2025-25176 | Analyzed | 未確認 | CWE-668 | Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform. |
| CVE-2025-25249 | Analyzed | 掲載 | CWE-122, CWE-787 | A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS |
| CVE-2025-25652 | Analyzed | 未確認 | CWE-22 | In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal. |
| CVE-2025-26385 | Deferred | 未確認 | CWE-77 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of t |
| CVE-2025-26386 | Deferred | 未確認 | CWE-121 | Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Succ |
| CVE-2025-2668 | Analyzed | 未確認 | CWE-770, CWE-789 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a |
| CVE-2025-27002 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background countdown-with-backgroun |
| CVE-2025-27004 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin |
| CVE-2025-27005 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Video Player lbg-vp2-html5-bottom allows Reflected XSS.This |
| CVE-2025-27377 | Analyzed | 未確認 | CWE-295 | Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a man-in-the-middle (MITM) attack could ex |
| CVE-2025-27378 | Analyzed | 未確認 | CWE-20, CWE-89 | AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, c |
| CVE-2025-27379 | Analyzed | 未確認 | CWE-79 | A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field o |
| CVE-2025-27380 | Analyzed | 未確認 | CWE-79 | HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser |
| CVE-2025-27807 | Analyzed | 未確認 | CWE-787 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W10 |
| CVE-2025-27821 | Analyzed | 未確認 | CWE-787 | Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client. This issue affects Apache Hadoop: from 3.2.0 before 3.4.2. Users are recommended to upgrade to version 3.4. |
| CVE-2025-28162 | Analyzed | 未確認 | CWE-120 | Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory i |
| CVE-2025-28164 | Analyzed | 未確認 | CWE-120, CWE-401 | Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function. |
| CVE-2025-29004 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPre |
| CVE-2025-29329 | Modified | 未確認 | CWE-120 | Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by sending a crafted HTTP |
| CVE-2025-29847 | Analyzed | 未確認 | CWE-20, CWE-22 | A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured o |
| CVE-2025-29943 | Deferred | 未確認 | CWE-123 | Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stac |
| CVE-2025-30248 | Deferred | 未確認 | CWE-427 | DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in t |
| CVE-2025-30631 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for |
| CVE-2025-30633 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue |
| CVE-2025-30996 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themi |
| CVE-2025-31044 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue affects Premium SEO P |
| CVE-2025-31046 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor |
| CVE-2025-31047 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0. |
| CVE-2025-31048 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4. |
| CVE-2025-31051 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Retrieve Embedded Sensi |
| CVE-2025-31186 | Analyzed | 未確認 | CWE-284 | A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences. |
| CVE-2025-31413 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Cross Site Request Forgery.This issue affects Element Pa |
| CVE-2025-31510 | Deferred | 未確認 | CWE-79 | In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, |
| CVE-2025-31642 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n |
| CVE-2025-31643 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0. |
| CVE-2025-31962 | Analyzed | 未確認 | CWE-613 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to prote |
| CVE-2025-31963 | Analyzed | 未確認 | CWE-306, CWE-352 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configurati |
| CVE-2025-31964 | Analyzed | 未確認 | CWE-200, CWE-419 | Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of admi |
| CVE-2025-32056 | Deferred | 未確認 | CWE-1241 | The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding respons |
| CVE-2025-32057 | Deferred | 未確認 | CWE-295 | The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-the-air provisioning and updates. HTTPS is used for communic |
| CVE-2025-32123 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Video Player with Playlist & Multiple Skins lbg-vp2-html5-r |
| CVE-2025-32300 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects |
| CVE-2025-32303 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from |
| CVE-2025-32304 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issu |
| CVE-2025-33015 | Analyzed | 未確認 | CWE-434 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. |
| CVE-2025-33206 | Analyzed | 未確認 | CWE-78 | NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection. A successful exploit of this vulnerability might lead to code execution, |
| CVE-2025-33217 | Deferred | 未確認 | CWE-416 | NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. A successful exploit of this vulnerability might lead to code execution |
| CVE-2025-33218 | Deferred | 未確認 | CWE-190 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where an attacker could cause an integer overflow. A successful exploit of t |
| CVE-2025-33219 | Deferred | 未確認 | CWE-190 | NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wraparound. A successful exploit of this v |
| CVE-2025-33220 | Deferred | 未確認 | CWE-416 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A successful exploit of |
| CVE-2025-33228 | Analyzed | 未確認 | CWE-78 | NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the process_nsys_ |
| CVE-2025-33229 | Analyzed | 未確認 | CWE-427 | NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the same privileges as the NVIDIA Nsight Visual |
| CVE-2025-33230 | Analyzed | 未確認 | CWE-78 | NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the install |
| CVE-2025-33231 | Analyzed | 未確認 | CWE-427 | NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncontrolled search path element by exploitin |
| CVE-2025-33233 | Deferred | 未確認 | CWE-94 | NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. A successful exploit of this vulnerability might lead to cod |
| CVE-2025-33234 | Deferred | 未確認 | CWE-78 | NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, esc |
| CVE-2025-33237 | Deferred | 未確認 | CWE-476 | NVIDIA HD Audio Driver for Windows contains a vulnerability where an attacker could exploit a NULL pointer dereference issue. A successful exploit of this vulnerability might lead |
| CVE-2025-34094 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34122 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34131 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34137 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34144 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34145 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34166 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34167 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34168 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34169 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34170 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34171 | Analyzed | 未確認 | CWE-497, CWE-862 | CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug informat |
| CVE-2025-34213 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34214 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34219 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34250 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34268 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34275 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34276 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34279 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34285 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34289 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34295 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34296 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34321 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34325 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34326 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34327 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34338 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34339 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34340 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34341 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34342 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34343 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34344 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34345 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34346 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34347 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34348 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34349 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34353 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34354 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34355 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34356 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34357 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34358 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34359 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34360 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34361 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34362 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34363 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34364 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34365 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34366 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34367 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34368 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34369 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34370 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34371 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34372 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34373 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34374 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34375 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34376 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34377 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34378 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34379 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34380 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34381 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34382 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34383 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34384 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34385 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34386 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34387 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34388 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34389 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34390 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34391 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34405 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34415 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34426 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34431 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34432 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34443 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34444 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34445 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34446 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34447 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34448 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34453 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34454 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34455 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34456 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34459 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34460 | Rejected | 未確認 | Rejected reason: This candidate has been reserved by a CVE Numbering Authority (CNA). | |
| CVE-2025-34461 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34462 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34463 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34464 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34465 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34466 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34470 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34471 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34472 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34473 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34474 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34475 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34476 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34477 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34478 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34479 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34480 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34481 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34482 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34483 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34484 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34485 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34486 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34487 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34488 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34492 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34493 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34494 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34495 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34496 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34497 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34498 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34505 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34507 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34524 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34525 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34526 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34527 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34528 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34529 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34530 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34531 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34532 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34533 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34534 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34535 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34536 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34537 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34538 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34539 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34540 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34541 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34542 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34543 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34544 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34545 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34546 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34547 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34548 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34549 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34550 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34551 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34552 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34553 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34554 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34555 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34556 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34557 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34558 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34559 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34560 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34561 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34562 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34563 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34564 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34565 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34566 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34567 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34568 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34569 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34570 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34571 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34572 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34573 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34574 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34575 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34576 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34577 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34578 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34579 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34580 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34581 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34582 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34583 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34584 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34585 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34586 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34587 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34588 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34589 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34590 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34591 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34592 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34593 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34594 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34595 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34596 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34597 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34598 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34599 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34600 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34601 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34602 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34603 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34604 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34605 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34606 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34607 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34608 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34609 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34610 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34611 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34612 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34613 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34614 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34615 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34616 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34617 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34618 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34619 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34620 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34621 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34622 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34623 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34624 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34625 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34626 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34627 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34628 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34629 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34630 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34631 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34632 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34633 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34634 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34635 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34636 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34637 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34638 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34639 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34640 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34641 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34642 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34643 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34644 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34645 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34646 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34647 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34648 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34649 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34650 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34651 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34652 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34653 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34654 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34655 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34656 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34657 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34658 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34659 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34660 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34661 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34662 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34663 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34664 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34665 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34666 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34667 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34668 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34669 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34670 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34671 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34672 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34673 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34674 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34675 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34676 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34677 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34678 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34679 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34680 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34681 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34682 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34683 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34684 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34685 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34686 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34687 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34688 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34689 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34690 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34691 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34692 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34693 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34694 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34695 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34696 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34697 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34698 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34699 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34700 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34701 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34702 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34703 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34704 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34705 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34706 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34707 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34708 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34709 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34710 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34711 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34712 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34713 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34714 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34715 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34716 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34717 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34718 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34719 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34720 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34721 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34722 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34723 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34724 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34725 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34726 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34727 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34728 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34729 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34730 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34731 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34732 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34733 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34734 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34735 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34736 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34737 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34738 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34739 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34740 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34741 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34742 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34743 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34744 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34745 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34746 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34747 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34748 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34749 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34750 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34751 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34752 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34753 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34754 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34755 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34756 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34757 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34758 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34759 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34760 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34761 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34762 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34763 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34764 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34765 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34766 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34767 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34768 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34769 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34770 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34771 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34772 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34773 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34774 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34775 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34776 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34777 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34778 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34779 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34780 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34781 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34782 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34783 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34784 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34785 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34786 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34787 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34788 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34789 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34790 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34791 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34792 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34793 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34794 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34795 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34796 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34797 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34798 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34799 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34800 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34801 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34802 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34803 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34804 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34805 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34806 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34807 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34808 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34809 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34810 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34811 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34812 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34813 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34814 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34815 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34816 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34817 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34818 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34819 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34820 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34821 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34822 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34823 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34824 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34825 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34826 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34827 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34828 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34829 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34830 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34831 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34832 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34833 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34834 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34835 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34836 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34837 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34838 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34839 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34840 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34841 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34842 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34843 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34844 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34845 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34846 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34847 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34848 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34849 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34850 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34851 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34852 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34853 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34854 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34855 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34856 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34857 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34858 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34859 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34860 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34861 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34862 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34863 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34864 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34865 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34866 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34867 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34868 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34869 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34870 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34871 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34872 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34873 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34874 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34875 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34876 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34877 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34878 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34879 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34880 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34881 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34882 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34883 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34884 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34885 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34886 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34887 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34888 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34889 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34890 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34891 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34892 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34893 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34894 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34895 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34896 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34897 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34898 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34899 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34900 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34901 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34902 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34903 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34904 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34905 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34906 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34907 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34908 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34909 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34910 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34911 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34912 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34913 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34914 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34915 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34916 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34917 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34918 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34919 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34920 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34921 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34922 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34923 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34924 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34925 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34926 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34927 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34928 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34929 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34930 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34931 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34932 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34933 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34934 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34935 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34936 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34937 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34938 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34939 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34940 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34941 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34942 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34943 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34944 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34945 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34946 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34947 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34948 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34949 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34950 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34951 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34952 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34953 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34954 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34955 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34956 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34957 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34958 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34959 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34960 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34961 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34962 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34963 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34964 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34965 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34966 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34967 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34968 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34969 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34970 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34971 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34972 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34973 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34974 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34975 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34976 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34977 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34978 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34979 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34980 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34981 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34982 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34983 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34984 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34985 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34986 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34987 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34988 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34989 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34990 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34991 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34992 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34993 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34994 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34995 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34996 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34997 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34998 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-34999 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-35000 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-35001 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-35002 | Rejected | 未確認 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. | |
| CVE-2025-36001 | Analyzed | 未確認 | CWE-674 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a special |
| CVE-2025-36009 | Analyzed | 未確認 | CWE-1284 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable. |
| CVE-2025-36058 | Analyzed | 未確認 | CWE-538 | IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak f |
| CVE-2025-36059 | Analyzed | 未確認 | CWE-250 | IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak f |
| CVE-2025-36063 | Analyzed | 未確認 | CWE-613 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a logout which could allow an authenticated user |
| CVE-2025-36065 | Analyzed | 未確認 | CWE-613 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a browser closure which could allow an authentica |
| CVE-2025-36066 | Analyzed | 未確認 | CWE-79 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated |
| CVE-2025-36070 | Analyzed | 未確認 | CWE-770 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from |
| CVE-2025-36098 | Analyzed | 未確認 | CWE-770 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper |
| CVE-2025-36113 | Analyzed | 未確認 | CWE-79 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an authenticated u |
| CVE-2025-36115 | Analyzed | 未確認 | CWE-384 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an authenticated user to imp |
| CVE-2025-36123 | Analyzed | 未確認 | CWE-770 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table |
| CVE-2025-36184 | Analyzed | 未確認 | CWE-250 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due |
| CVE-2025-36353 | Analyzed | 未確認 | CWE-943 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutrali |
| CVE-2025-36365 | Analyzed | 未確認 | CWE-639 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow a |
| CVE-2025-36366 | Analyzed | 未確認 | CWE-943 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, |
| CVE-2025-36384 | Analyzed | 未確認 | CWE-428 | IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element. |
| CVE-2025-36387 | Analyzed | 未確認 | CWE-770 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query. |
| CVE-2025-36396 | Analyzed | 未確認 | CWE-79 | IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI |
| CVE-2025-36397 | Analyzed | 未確認 | CWE-80 | IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim' |
| CVE-2025-36407 | Modified | 未確認 | CWE-1284 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. |
| CVE-2025-36408 | Analyzed | 未確認 | CWE-79 | IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the in |
| CVE-2025-36409 | Analyzed | 未確認 | CWE-79 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended |
| CVE-2025-36410 | Analyzed | 未確認 | CWE-602 | IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security. |
| CVE-2025-36411 | Analyzed | 未確認 | CWE-352 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website tr |
| CVE-2025-36418 | Analyzed | 未確認 | CWE-347 | IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token i |
| CVE-2025-36419 | Analyzed | 未確認 | CWE-550 | IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. |
| CVE-2025-36423 | Analyzed | 未確認 | CWE-1284 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special el |
| CVE-2025-36424 | Analyzed | 未確認 | CWE-1284 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query l |
| CVE-2025-36427 | Analyzed | 未確認 | CWE-1284 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special elements in data query l |
| CVE-2025-36428 | Analyzed | 未確認 | CWE-1284 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper |
| CVE-2025-36442 | Analyzed | 未確認 | CWE-943 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain con |
| CVE-2025-3646 | Analyzed | 未確認 | CWE-306 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared owners to any device b |
| CVE-2025-3652 | Analyzed | 未確認 | CWE-288 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to private audio recordings by exploiting |
| CVE-2025-3653 | Analyzed | 未確認 | CWE-612 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by accepting arbitrary seria |
| CVE-2025-3654 | Analyzed | 未確認 | CWE-612 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiti |
| CVE-2025-36556 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrar |
| CVE-2025-36588 | Modified | 未確認 | CWE-89 | Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged |
| CVE-2025-36589 | Analyzed | 未確認 | CWE-611 | Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access cou |
| CVE-2025-3660 | Analyzed | 未確認 | CWE-612 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploitin |
| CVE-2025-36640 | Deferred | 未確認 | CWE-269 | A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges. |
| CVE-2025-36911 | Modified | 未確認 | In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and loca | |
| CVE-2025-37165 | Deferred | 未確認 | CWE-200 | A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor could gai |
| CVE-2025-37166 | Deferred | 未確認 | CWE-770 | A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-responsive state, in so |
| CVE-2025-37168 | Analyzed | 未確認 | CWE-552 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability |
| CVE-2025-37169 | Modified | 未確認 | CWE-121, CWE-787 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to ex |
| CVE-2025-37170 | Analyzed | 未確認 | CWE-78 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could all |
| CVE-2025-37171 | Analyzed | 未確認 | CWE-78 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could all |
| CVE-2025-37172 | Analyzed | 未確認 | CWE-78 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could all |
| CVE-2025-37173 | Analyzed | 未確認 | CWE-20 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitati |
| CVE-2025-37174 | Analyzed | 未確認 | CWE-277 | Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful ex |
| CVE-2025-37175 | Analyzed | 未確認 | CWE-434 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation co |
| CVE-2025-37176 | Analyzed | 未確認 | CWE-77 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of intern |
| CVE-2025-37177 | Analyzed | 未確認 | CWE-552 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful explo |
| CVE-2025-37178 | Analyzed | 未確認 | CWE-125 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer si |
| CVE-2025-37179 | Analyzed | 未確認 | CWE-125 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer si |
| CVE-2025-37181 | Analyzed | 未確認 | CWE-89 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful |
| CVE-2025-37182 | Analyzed | 未確認 | CWE-89 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful |
| CVE-2025-37183 | Analyzed | 未確認 | CWE-89 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful |
| CVE-2025-37184 | Modified | 未確認 | CWE-287 | A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation co |
| CVE-2025-37185 | Analyzed | 未確認 | CWE-79 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) |
| CVE-2025-37186 | Deferred | 未確認 | CWE-269 | A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could |
| CVE-2025-3839 | Deferred | 未確認 | CWE-356 | A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabili |
| CVE-2025-39477 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a thr |
| CVE-2025-39484 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a throu |
| CVE-2025-39497 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Dokan Pro: from n/a throu |
| CVE-2025-3950 | Analyzed | 未確認 | CWE-359 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak cer |
| CVE-2025-39561 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a |
| CVE-2025-40536 | Analyzed | 掲載 | CWE-693 | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain |
| CVE-2025-40537 | Analyzed | 未確認 | CWE-798 | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions. |
| CVE-2025-40551 | Analyzed | 掲載 | CWE-502 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to r |
| CVE-2025-40552 | Modified | 未確認 | CWE-1390 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that |
| CVE-2025-40553 | Modified | 未確認 | CWE-502 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to r |
| CVE-2025-40554 | Analyzed | 未確認 | CWE-1390 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Hel |
| CVE-2025-40644 | Deferred | 未確認 | CWE-79 | Reflected Cross-Site Scripting (XSS) vulnerability in Riftzilla's QRGen. This vulnerability allows an attavker to execute JavaScript code in the victim's browser by sending them a |
| CVE-2025-40679 | Deferred | 未確認 | CWE-79 | HTML Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request to '/category_produc |
| CVE-2025-40805 | Deferred | 未確認 | CWE-639 | Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and im |
| CVE-2025-40942 | Analyzed | 未確認 | CWE-250 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege escalation vulnerability that could allow |
| CVE-2025-40944 | Deferred | 未確認 | CWE-400 | A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (All versions >= V4.2. |
| CVE-2025-40975 | Deferred | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's HRMGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/hrmgo/ticket/changereply’, |
| CVE-2025-40976 | Deferred | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, us |
| CVE-2025-40977 | Deferred | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, |
| CVE-2025-40978 | Deferred | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request |
| CVE-2025-41003 | Deferred | 未確認 | CWE-79 | Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.php’. By injecting a ma |
| CVE-2025-41004 | Deferred | 未確認 | CWE-89 | Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter. |
| CVE-2025-41005 | Deferred | 未確認 | CWE-89 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchange_offers.php’. |
| CVE-2025-41006 | Deferred | 未確認 | CWE-89 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’. |
| CVE-2025-41024 | Analyzed | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The relationship between para |
| CVE-2025-41025 | Analyzed | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The relationship between para |
| CVE-2025-41077 | Analyzed | 未確認 | CWE-639 | IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data |
| CVE-2025-41078 | Analyzed | 未確認 | CWE-863 | Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modi |
| CVE-2025-41081 | Deferred | 未確認 | CWE-79 | Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending t |
| CVE-2025-41082 | Deferred | 未確認 | CWE-444 | Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single Keep-Alive connection us |
| CVE-2025-41083 | Deferred | 未確認 | CWE-74 | Vulnerability in Altitude Authentication Service and Altitude Communication Server v8.5.3290.0 by Altitude, where manipulation of Host header in HTTP requests allows redirection to |
| CVE-2025-41084 | Deferred | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) vulnerability in Sesame web application, due to the fact that uploaded SVG images are not properly sanitized. This allows attackers to embed malic |
| CVE-2025-41351 | Deferred | 未確認 | CWE-649 | Vulnerability that allows a Padding Oracle Attack to be performed on the Funambol v30.0.0.20 cloud server. The thumbnail display URL allows an attacker to decrypt and encrypt the p |
| CVE-2025-41717 | Deferred | 未確認 | CWE-94 | An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This resul |
| CVE-2025-41726 | Deferred | 未確認 | CWE-190 | A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer |
| CVE-2025-41727 | Deferred | 未確認 | CWE-420 | A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access. |
| CVE-2025-41728 | Deferred | 未確認 | CWE-125 | A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager w |
| CVE-2025-41768 | Deferred | 未確認 | CWE-79 | An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation |
| CVE-2025-4319 | Deferred | 未確認 | CWE-307, CWE-640 | Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Su |
| CVE-2025-4320 | Deferred | 未確認 | CWE-305, CWE-640 | Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Au |
| CVE-2025-43508 | Analyzed | 未確認 | CWE-532 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
| CVE-2025-43706 | Analyzed | 未確認 | CWE-400 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920, W930, Modem 5123, and Modem 5400. Incor |
| CVE-2025-43904 | Deferred | 未確認 | CWE-863 | In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator. |
| CVE-2025-44000 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the sendOruReport functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arb |
| CVE-2025-44013 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vu |
| CVE-2025-45160 | Deferred | 未確認 | CWE-80 | A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects the submitted fi |
| CVE-2025-45286 | Analyzed | 未確認 | CWE-80 | A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2025-4596 | Deferred | 未確認 | CWE-639 | Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containi |
| CVE-2025-46066 | Analyzed | 未確認 | CWE-280 | An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges |
| CVE-2025-46067 | Analyzed | 未確認 | CWE-259 | An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file |
| CVE-2025-46068 | Analyzed | 未確認 | CWE-434 | An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism |
| CVE-2025-46070 | Analyzed | 未確認 | CWE-295 | An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component |
| CVE-2025-46255 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a t |
| CVE-2025-46256 | Deferred | 未確認 | CWE-35 | Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2. |
| CVE-2025-46270 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the fetchPriorStudies functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to |
| CVE-2025-46286 | Analyzed | 未確認 | CWE-288 | A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent passcode from being required immediately |
| CVE-2025-46297 | Analyzed | 未確認 | CWE-284 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected files within an App Sandbox containe |
| CVE-2025-46298 | Modified | 未確認 | CWE-119 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Proce |
| CVE-2025-46299 | Modified | 未確認 | CWE-284 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, |
| CVE-2025-46306 | Modified | 未確認 | CWE-125 | The issue was addressed with improved bounds checks. This issue is fixed in Keynote 15.1, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing a maliciously crafted Keynote file may di |
| CVE-2025-46316 | Modified | 未確認 | CWE-125 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in Pages 15.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1. Processing a maliciously crafted |
| CVE-2025-46434 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured Access Control Securit |
| CVE-2025-46494 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue affects WidgetKit Pr |
| CVE-2025-46643 | Analyzed | 未確認 | CWE-122, CWE-787 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versi |
| CVE-2025-46644 | Analyzed | 未確認 | CWE-78 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versi |
| CVE-2025-46645 | Analyzed | 未確認 | CWE-78 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versi |
| CVE-2025-46676 | Analyzed | 未確認 | CWE-200 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versi |
| CVE-2025-46684 | Analyzed | 未確認 | CWE-378 | Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local acces |
| CVE-2025-46685 | Analyzed | 未確認 | CWE-378 | Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local acces |
| CVE-2025-46691 | Analyzed | 未確認 | CWE-284 | Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially expl |
| CVE-2025-46696 | Analyzed | 未確認 | CWE-250 | Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary Privileges vulnerability. A high privile |
| CVE-2025-46699 | Analyzed | 未確認 | CWE-1336 | Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability in the Server. A low privileg |
| CVE-2025-4675 | Deferred | 未確認 | CWE-754 | Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerV |
| CVE-2025-4676 | Deferred | 未確認 | CWE-303 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerV |
| CVE-2025-4677 | Deferred | 未確認 | CWE-613 | Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K |
| CVE-2025-4686 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. On |
| CVE-2025-47208 | Analyzed | 未確認 | CWE-770 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, |
| CVE-2025-47330 | Analyzed | 未確認 | CWE-126 | Transient DOS while parsing video packets received from the video firmware. |
| CVE-2025-47331 | Analyzed | 未確認 | CWE-126 | Information disclosure while processing a firmware event. |
| CVE-2025-47332 | Analyzed | 未確認 | CWE-367 | Memory corruption while processing a config call from userspace. |
| CVE-2025-47333 | Analyzed | 未確認 | CWE-416 | Memory corruption while handling buffer mapping operations in the cryptographic driver. |
| CVE-2025-47334 | Analyzed | 未確認 | CWE-120 | Memory corruption while processing shared command buffer packet between camera userspace and kernel. |
| CVE-2025-47335 | Analyzed | 未確認 | CWE-120 | Memory corruption while parsing clock configuration data for a specific hardware type. |
| CVE-2025-47336 | Analyzed | 未確認 | CWE-416 | Memory corruption while performing sensor register read operations. |
| CVE-2025-47337 | Analyzed | 未確認 | CWE-416 | Memory corruption while accessing a synchronization object during concurrent operations. |
| CVE-2025-47339 | Analyzed | 未確認 | CWE-416 | Memory corruption while deinitializing a HDCP session. |
| CVE-2025-47343 | Analyzed | 未確認 | CWE-822 | Memory corruption while processing a video session to set video parameters. |
| CVE-2025-47344 | Analyzed | 未確認 | CWE-367 | Memory corruption while handling sensor utility operations. |
| CVE-2025-47345 | Analyzed | 未確認 | CWE-323 | Cryptographic issue may occur while encrypting license data. |
| CVE-2025-47346 | Analyzed | 未確認 | CWE-787 | Memory corruption while processing a secure logging command in the trusted application. |
| CVE-2025-47348 | Analyzed | 未確認 | CWE-457 | Memory corruption while processing identity credential operations in the trusted application. |
| CVE-2025-47356 | Analyzed | 未確認 | CWE-415 | Memory Corruption when multiple threads concurrently access and modify shared resources. |
| CVE-2025-47369 | Analyzed | 未確認 | CWE-200 | Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. |
| CVE-2025-47380 | Analyzed | 未確認 | CWE-822 | Memory corruption while preprocessing IOCTLs in sensors. |
| CVE-2025-47388 | Analyzed | 未確認 | CWE-120 | Memory corruption while passing pages to DSP with an unaligned starting address. |
| CVE-2025-47393 | Analyzed | 未確認 | CWE-129 | Memory corruption when accessing resources in kernel driver. |
| CVE-2025-47394 | Analyzed | 未確認 | CWE-120 | Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. |
| CVE-2025-47395 | Analyzed | 未確認 | CWE-126 | Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. |
| CVE-2025-47396 | Analyzed | 未確認 | CWE-415 | Memory corruption occurs when a secure application is launched on a device with insufficient memory. |
| CVE-2025-47411 | Analyzed | 未確認 | CWE-269 | A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an e |
| CVE-2025-47474 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ninetheme Anarkali anarkali allows PHP Local File Inclusion |
| CVE-2025-47500 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Stored XSS |
| CVE-2025-47552 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37. |
| CVE-2025-47553 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25. |
| CVE-2025-47555 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2025-47600 | Deferred | 未確認 | CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in xtemos WoodMart woodmart allows Code Injection.This issue affects WoodMart: from n/a |
| CVE-2025-4763 | Modified | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Re |
| CVE-2025-4764 | Modified | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injec |
| CVE-2025-47666 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider |
| CVE-2025-4776 | Deferred | 未確認 | CWE-79 | The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` HTML attribute in all versions up to, and including, 2.17.7 due to insufficient in |
| CVE-2025-47855 | Deferred | 未確認 | CWE-200 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthent |
| CVE-2025-48094 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Slider magic_slider allows Reflected XSS.This issue affects |
| CVE-2025-48647 | Analyzed | 未確認 | CWE-20 | In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of p |
| CVE-2025-48721 | Analyzed | 未確認 | CWE-120, CWE-121 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the v |
| CVE-2025-48768 | Analyzed | 未確認 | CWE-763 | Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed root filesystem inode removal leading to |
| CVE-2025-48769 | Analyzed | 未確認 | CWE-416 | Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer vari |
| CVE-2025-49043 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel all |
| CVE-2025-49045 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Interactive Maps super-interactive-maps allows Reflected XSS. |
| CVE-2025-49046 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup xPromoter top_bar_promoter allows Reflected XSS.This issue affect |
| CVE-2025-49049 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affe |
| CVE-2025-49050 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injectio |
| CVE-2025-49055 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injectio |
| CVE-2025-49066 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Accordion Slider PRO accordion_slider_pro allows Reflected XSS.Th |
| CVE-2025-49249 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Drone drone allows Reflected XSS.This issue affects Drone: from n/a |
| CVE-2025-49335 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in minnur External Media external-media allows Server Side Request Forgery.This issue affects External Media: from n/a through <= 1 |
| CVE-2025-49336 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pondol Pondol BBS pondol-bbs allows Stored XSS.This issue affects Pondol BBS: |
| CVE-2025-49375 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeLancer: from |
| CVE-2025-49495 | Analyzed | 未確認 | CWE-120 | An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580. Mishandling of an NL80211 vendor command leads to a buffer overflow. |
| CVE-2025-49994 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Athens athens allows PHP Local File Inclusion.This |
| CVE-2025-50002 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Upload a Web Shell to a Web Server.This issue affects Energia: from n/a through <= 1. |
| CVE-2025-50003 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Amuli amuli allows PHP Local File Inclusion.Thi |
| CVE-2025-50004 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1. |
| CVE-2025-50005 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows DOM-Based XSS.This issue affects tag |
| CVE-2025-50006 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes xSmart xsmart allows Reflected XSS.This issue affects xSmart: from n/a |
| CVE-2025-50007 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in Jthemes xSmart xsmart allows Privilege Escalation.This issue affects xSmart: from n/a through <= 1.2.9.4. |
| CVE-2025-50334 | Modified | 未確認 | CWE-770 | An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component |
| CVE-2025-50537 | Analyzed | 未確認 | CWE-674 | Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleT |
| CVE-2025-5102 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2025-51567 | Analyzed | 未確認 | CWE-89 | A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorize |
| CVE-2025-51602 | Deferred | 未確認 | CWE-125 | mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server. |
| CVE-2025-51626 | Analyzed | 未確認 | CWE-89 | SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint. |
| CVE-2025-51958 | Analyzed | 未確認 | CWE-78 | aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php. |
| CVE-2025-52022 | Modified | 未確認 | CWE-209 | A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal fi |
| CVE-2025-52023 | Modified | 未確認 | CWE-209 | A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file p |
| CVE-2025-52024 | Modified | 未確認 | CWE-306, CWE-425, CWE-862 | A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs |
| CVE-2025-52025 | Modified | 未確認 | CWE-89 | An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user inp |
| CVE-2025-52026 | Modified | 未確認 | CWE-200, CWE-327 | An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint ret |
| CVE-2025-52426 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-52430 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-52431 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-52435 | Analyzed | 未確認 | CWE-5 | J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously e |
| CVE-2025-52515 | Analyzed | 未確認 | CWE-362 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver r |
| CVE-2025-52516 | Analyzed | 未確認 | CWE-822 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address dereference in the iss |
| CVE-2025-52517 | Modified | 未確認 | CWE-362 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver r |
| CVE-2025-52519 | Analyzed | 未確認 | CWE-20 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of user-space input in t |
| CVE-2025-52659 | Analyzed | 未確認 | CWE-525 | HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorize |
| CVE-2025-52660 | Analyzed | 未確認 | CWE-644 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. |
| CVE-2025-52661 | Analyzed | 未確認 | CWE-613 | HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token i |
| CVE-2025-52694 | Modified | 未確認 | CWE-89 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exp |
| CVE-2025-52746 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ayecode Restaurante restaurante allows Reflected XSS.This issue affects Restau |
| CVE-2025-52762 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio flexo-posts-manager flexo-posts-manager allows Reflected XSS.This |
| CVE-2025-52863 | Analyzed | 未確認 | CWE-120 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerabili |
| CVE-2025-52864 | Analyzed | 未確認 | CWE-120 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerabili |
| CVE-2025-52871 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret |
| CVE-2025-52872 | Analyzed | 未確認 | CWE-120 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerabili |
| CVE-2025-52987 | Analyzed | 未確認 | CWE-1021 | A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) due to the application's failure to set appropriate X-F |
| CVE-2025-53240 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamlabs WordPress Photo Gallery photo-gallery-portfolio allows Reflected XSS. |
| CVE-2025-53344 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3. |
| CVE-2025-53405 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-53414 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-53470 | Analyzed | 未確認 | CWE-125 | Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: thr |
| CVE-2025-53477 | Analyzed | 未確認 | CWE-476 | NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue |
| CVE-2025-53516 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the downloadZip functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbit |
| CVE-2025-53589 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-53590 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-53591 | Analyzed | 未確認 | CWE-134 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, |
| CVE-2025-53592 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vu |
| CVE-2025-53593 | Analyzed | 未確認 | CWE-121, CWE-787 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the v |
| CVE-2025-53594 | Deferred | 未確認 | CWE-22, CWE-367, CWE-59 | A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the c |
| CVE-2025-53596 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then expl |
| CVE-2025-53597 | Analyzed | 未確認 | CWE-121, CWE-787 | A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify m |
| CVE-2025-53707 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to |
| CVE-2025-53854 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to ar |
| CVE-2025-53869 | Deferred | 未確認 | CWE-295 | Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the set of root certifica |
| CVE-2025-53912 | Analyzed | 未確認 | CWE-73 | An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead to an arbitrary file |
| CVE-2025-53966 | Analyzed | 未確認 | CWE-120 | An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow during handling o |
| CVE-2025-53968 | Analyzed | 未確認 | CWE-307 | This vulnerability arises because there are no limitations on the number of authentication attempts a user can make. An attacker can exploit this weakness by continuously sending |
| CVE-2025-54002 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart: from n/a through <= |
| CVE-2025-54003 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Depot depot allows PHP Local File Inclusion.T |
| CVE-2025-54157 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to a |
| CVE-2025-54164 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit t |
| CVE-2025-54165 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit t |
| CVE-2025-54166 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit t |
| CVE-2025-54373 | Analyzed | 未確認 | CWE-200 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sensitive data is uninte |
| CVE-2025-54495 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to ar |
| CVE-2025-54778 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbi |
| CVE-2025-54814 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lea |
| CVE-2025-54816 | Analyzed | 未確認 | CWE-306 | This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections. As a result, attacker |
| CVE-2025-54817 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the autoPurge functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbitra |
| CVE-2025-54852 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arb |
| CVE-2025-54853 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitr |
| CVE-2025-54861 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyCoercion functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to ar |
| CVE-2025-5489 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2025-55065 | Deferred | 未確認 | CWE-89 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| CVE-2025-55071 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to a |
| CVE-2025-55095 | Analyzed | 未確認 | CWE-121, CWE-674, CWE-787 | The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partiti |
| CVE-2025-55102 | Analyzed | 未確認 | CWE-400, CWE-404, CWE-770 | A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than |
| CVE-2025-55125 | Analyzed | 未確認 | CWE-77 | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file. |
| CVE-2025-55130 | Modified | 未確認 | CWE-281, CWE-289 | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories |
| CVE-2025-55131 | Deferred | 未確認 | CWE-120, CWE-497 | A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific tim |
| CVE-2025-55132 | Analyzed | 未確認 | CWE-276 | A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utime |
| CVE-2025-55204 | Analyzed | 未確認 | CWE-79, CWE-94 | muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attacker can exploit this i |
| CVE-2025-55249 | Analyzed | 未確認 | CWE-693 | HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increa |
| CVE-2025-55250 | Analyzed | 未確認 | CWE-209 | HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding |
| CVE-2025-55251 | Analyzed | 未確認 | CWE-434 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. |
| CVE-2025-55252 | Analyzed | 未確認 | CWE-521 | HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access |
| CVE-2025-55292 | Analyzed | 未確認 | CWE-348 | Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than the |
| CVE-2025-55423 | Analyzed | 未確認 | CWE-94 | A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an u |
| CVE-2025-55462 | Modified | 未確認 | CWE-942 | A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response |
| CVE-2025-55704 | Deferred | 未確認 | CWE-912 | Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product and obtain sensitive |
| CVE-2025-55705 | Analyzed | 未確認 | CWE-613 | This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charging station ID. This can result in unauthorized access, dat |
| CVE-2025-5591 | Analyzed | 未確認 | CWE-1188, CWE-79 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their |
| CVE-2025-56005 | Modified | 未確認 | CWE-502 | An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parame |
| CVE-2025-56225 | Analyzed | 未確認 | CWE-476 | fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi file. |
| CVE-2025-56226 | Analyzed | 未確認 | CWE-401 | Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file. |
| CVE-2025-56353 | Analyzed | 未確認 | CWE-401 | In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), a memory leak occurs due to the broker's failure to validate or reject malformed UTF-8 strings in topic fi |
| CVE-2025-56424 | Analyzed | 未確認 | CWE-400 | An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service via a crafted script |
| CVE-2025-56425 | Analyzed | 未確認 | CWE-77 | An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version 11.0.0.183 and earlier of enaio 11.0, an |
| CVE-2025-56451 | Analyzed | 未確認 | CWE-79 | Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main.do endpoint. |
| CVE-2025-56589 | Modified | 未確認 | CWE-918 | A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These v |
| CVE-2025-56590 | Modified | 未確認 | CWE-78 | An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system comm |
| CVE-2025-57155 | Analyzed | 未確認 | CWE-476 | NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to |
| CVE-2025-57156 | Analyzed | 未確認 | CWE-476 | NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remot |
| CVE-2025-57283 | Modified | 未確認 | CWE-78, CWE-94 | The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js. |
| CVE-2025-57681 | Analyzed | 未確認 | CWE-79 | The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or |
| CVE-2025-57705 | Analyzed | 未確認 | CWE-770 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrato |
| CVE-2025-57783 | Analyzed | 未確認 | Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources | |
| CVE-2025-57784 | Analyzed | 未確認 | Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client. | |
| CVE-2025-57785 | Analyzed | 未確認 | CWE-415 | A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code |
| CVE-2025-57786 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to ar |
| CVE-2025-57787 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbit |
| CVE-2025-57792 | Analyzed | 未確認 | CWE-89 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply |
| CVE-2025-57793 | Analyzed | 未確認 | CWE-89 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application component. Crafted inpu |
| CVE-2025-57794 | Analyzed | 未確認 | CWE-434 | Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restri |
| CVE-2025-57795 | Analyzed | 未確認 | CWE-434 | Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be levera |
| CVE-2025-57796 | Analyzed | 未確認 | CWE-257 | Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurati |
| CVE-2025-57836 | Analyzed | 未確認 | CWE-427 | An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions during installation, allowing a non-admin |
| CVE-2025-57881 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyEmail functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbit |
| CVE-2025-5805 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Ninetheme Electron electron allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electron: from n/a thr |
| CVE-2025-58080 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7App functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbi |
| CVE-2025-58087 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58088 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58089 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58090 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58091 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58092 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58093 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58094 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58095 | Analyzed | 未確認 | CWE-79 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to |
| CVE-2025-58150 | Analyzed | 未確認 | CWE-787 | Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest control |
| CVE-2025-58409 | Analyzed | 未確認 | CWE-119 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstance |
| CVE-2025-58411 | Analyzed | 未確認 | CWE-416 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free |
| CVE-2025-58441 | Analyzed | 未確認 | CWE-918 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows a |
| CVE-2025-58693 | Analyzed | 未確認 | CWE-22 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a |
| CVE-2025-58740 | Analyzed | 未確認 | CWE-321 | The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local attacker to decrypt data |
| CVE-2025-58741 | Analyzed | 未確認 | CWE-522 | Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables database access.This |
| CVE-2025-58742 | Analyzed | 未確認 | CWE-522, CWE-923 | Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Ca |
| CVE-2025-58743 | Analyzed | 未確認 | CWE-327 | Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows allows Encryption Brut |
| CVE-2025-58744 | Analyzed | 未確認 | CWE-1392, CWE-798 | Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of document archive files |
| CVE-2025-59020 | Analyzed | 未確認 | CWE-863 | By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary da |
| CVE-2025-59021 | Analyzed | 未確認 | CWE-862 | Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to th |
| CVE-2025-59022 | Analyzed | 未確認 | CWE-862 | Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that parti |
| CVE-2025-59057 | Modified | 未確認 | CWE-79 | React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router |
| CVE-2025-59090 | Deferred | 未確認 | CWE-1188, CWE-306 | On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server |
| CVE-2025-59091 | Deferred | 未確認 | CWE-798 | Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying |
| CVE-2025-59092 | Deferred | 未確認 | CWE-798 | An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used for interprocess communication between se |
| CVE-2025-59093 | Deferred | 未確認 | CWE-656 | Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concate |
| CVE-2025-59094 | Deferred | 未確認 | CWE-269 | A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify |
| CVE-2025-59095 | Deferred | 未確認 | CWE-798 | The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.com |
| CVE-2025-59096 | Deferred | 未確認 | CWE-798 | The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in t |
| CVE-2025-59097 | Deferred | 未確認 | CWE-1188, CWE-306 | The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. |
| CVE-2025-59098 | Deferred | 未確認 | CWE-497 | The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceC |
| CVE-2025-59099 | Deferred | 未確認 | CWE-35 | The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to di |
| CVE-2025-59100 | Deferred | 未確認 | CWE-285 | The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After |
| CVE-2025-59101 | Deferred | 未確認 | CWE-291 | Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication requ |
| CVE-2025-59102 | Deferred | 未確認 | CWE-312 | The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This in |
| CVE-2025-59103 | Deferred | 未確認 | CWE-1391 | The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an S |
| CVE-2025-59104 | Deferred | 未確認 | CWE-1234 | With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains ac |
| CVE-2025-59105 | Deferred | 未確認 | CWE-312 | With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, |
| CVE-2025-59106 | Analyzed | 未確認 | CWE-272 | The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an |
| CVE-2025-59107 | Deferred | 未確認 | CWE-798 | Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP |
| CVE-2025-59108 | Deferred | 未確認 | CWE-1392 | By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced. |
| CVE-2025-59109 | Deferred | 未確認 | CWE-1295 | The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can |
| CVE-2025-59156 | Analyzed | 未確認 | CWE-78 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability e |
| CVE-2025-59157 | Analyzed | 未確認 | CWE-78 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creat |
| CVE-2025-59158 | Analyzed | 未確認 | CWE-116, CWE-79 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a st |
| CVE-2025-5919 | Deferred | 未確認 | CWE-862 | The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability |
| CVE-2025-59355 | Analyzed | 未確認 | CWE-532 | A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.err |
| CVE-2025-59379 | Analyzed | 未確認 | CWE-89 | DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Blind SQL Injection thro |
| CVE-2025-59380 | Analyzed | 未確認 | CWE-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vu |
| CVE-2025-59381 | Modified | 未確認 | CWE-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vu |
| CVE-2025-59384 | Analyzed | 未確認 | CWE-22 | A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. |
| CVE-2025-59387 | Deferred | 未確認 | CWE-89 | An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorize |
| CVE-2025-59389 | Analyzed | 未確認 | CWE-89 | An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. |
| CVE-2025-59464 | Analyzed | 未確認 | CWE-400 | A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPe |
| CVE-2025-59465 | Modified | 未確認 | CWE-248, CWE-400 | A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely clos |
| CVE-2025-59466 | Analyzed | 未確認 | CWE-248 | We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reachin |
| CVE-2025-59467 | Analyzed | 未確認 | CWE-79 | A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visi |
| CVE-2025-59468 | Analyzed | 未確認 | CWE-77 | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter. |
| CVE-2025-59469 | Analyzed | 未確認 | CWE-200 | This vulnerability allows a Backup or Tape Operator to write files as root. |
| CVE-2025-59470 | Analyzed | 未確認 | CWE-77 | This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter. |
| CVE-2025-59471 | Analyzed | 未確認 | CWE-400 | A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next |
| CVE-2025-59472 | Analyzed | 未確認 | CWE-400 | A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated P |
| CVE-2025-59473 | Analyzed | 未確認 | CWE-89 | SQL Injection vulnerability in the Structure for Admin authenticated user |
| CVE-2025-5965 | Analyzed | 未確認 | CWE-78 | In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Comma |
| CVE-2025-59870 | Analyzed | 未確認 | CWE-323 | HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk |
| CVE-2025-59891 | Analyzed | 未確認 | CWE-352 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perf |
| CVE-2025-59892 | Analyzed | 未確認 | CWE-352 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perf |
| CVE-2025-59893 | Analyzed | 未確認 | CWE-352 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perf |
| CVE-2025-59894 | Analyzed | 未確認 | CWE-352 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perf |
| CVE-2025-59895 | Analyzed | 未確認 | CWE-20 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore functionality. The iss |
| CVE-2025-59896 | Analyzed | 未確認 | CWE-79 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malici |
| CVE-2025-59897 | Analyzed | 未確認 | CWE-79 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malici |
| CVE-2025-59898 | Analyzed | 未確認 | CWE-79 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malici |
| CVE-2025-59899 | Analyzed | 未確認 | CWE-79 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malici |
| CVE-2025-59900 | Analyzed | 未確認 | CWE-79 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malici |
| CVE-2025-59901 | Deferred | 未確認 | CWE-352 | Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directo |
| CVE-2025-59922 | Analyzed | 未確認 | CWE-89 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiCl |
| CVE-2025-59955 | Analyzed | 未確認 | CWE-201, CWE-212, CWE-214 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information di |
| CVE-2025-59959 | Analyzed | 未確認 | CWE-822 | An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with lo |
| CVE-2025-59960 | Analyzed | 未確認 | CWE-754 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Juniper DHCP service (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a DHCP client in |
| CVE-2025-59961 | Analyzed | 未確認 | CWE-732 | An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-pri |
| CVE-2025-60003 | Analyzed | 未確認 | CWE-126 | A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a |
| CVE-2025-60007 | Modified | 未確認 | CWE-476 | A NULL Pointer Dereference vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause |
| CVE-2025-60011 | Analyzed | 未確認 | CWE-754 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticat |
| CVE-2025-60021 | Analyzed | 未確認 | CWE-77 | Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root |
| CVE-2025-60262 | Analyzed | 未確認 | CWE-276 | An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vuln |
| CVE-2025-60534 | Modified | 未確認 | CWE-287 | Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate functionality on the |
| CVE-2025-60538 | Analyzed | 未確認 | CWE-290 | A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack. |
| CVE-2025-61140 | Analyzed | 未確認 | CWE-1321, CWE-502 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. |
| CVE-2025-61246 | Analyzed | 未確認 | CWE-89 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter. |
| CVE-2025-61489 | Analyzed | 未確認 | CWE-77 | A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafted command string. |
| CVE-2025-61492 | Analyzed | 未確認 | CWE-77 | A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input. |
| CVE-2025-61546 | Modified | 未確認 | CWE-20 | There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) that enables remote at |
| CVE-2025-61547 | Modified | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). The application does not implement pr |
| CVE-2025-61548 | Modified | 未確認 | CWE-89 | SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version |
| CVE-2025-61549 | Modified | 未確認 | CWE-79 | Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixe |
| CVE-2025-61550 | Modified | 未確認 | CWE-79 | Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Sh |
| CVE-2025-61674 | Analyzed | 未確認 | CWE-79 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend |
| CVE-2025-61676 | Analyzed | 未確認 | CWE-79 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified in October CMS backe |
| CVE-2025-61684 | Analyzed | 未確認 | CWE-20, CWE-617 | Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit t |
| CVE-2025-61686 | Modified | 未確認 | CWE-22 | React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if cre |
| CVE-2025-61726 | Modified | 未確認 | CWE-770 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum reques |
| CVE-2025-61728 | Analyzed | 未確認 | CWE-770 | archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a ma |
| CVE-2025-61730 | Analyzed | 未確認 | During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the s | |
| CVE-2025-61731 | Modified | 未確認 | CWE-88 | Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go |
| CVE-2025-61781 | Analyzed | 未確認 | CWE-285, CWE-566, CWE-863, CWE-915 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" |
| CVE-2025-61782 | Analyzed | 未確認 | CWE-601 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI pl |
| CVE-2025-61873 | Deferred | 未確認 | CWE-1236 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. |
| CVE-2025-61916 | Analyzed | 未確認 | CWE-20, CWE-523, CWE-918 | Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary |
| CVE-2025-61937 | Analyzed | 未確認 | CWE-94 | The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting i |
| CVE-2025-61939 | Analyzed | 未確認 | CWE-923 | An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin acces |
| CVE-2025-61943 | Analyzed | 未確認 | CWE-89 | The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code executio |
| CVE-2025-61973 | Deferred | 未確認 | CWE-284 | A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A low-privilege user can replace a DLL file during the instal |
| CVE-2025-62050 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogmatic blogmatic.This issue affects Blogmatic: from n/a through <= 1.0.3. |
| CVE-2025-62056 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes News Event news-event.This issue affects News Event: from n/a through <= 1.0.1. |
| CVE-2025-62077 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SEOSEON EUROPE S.L Affiliate Link Tracker affiliate-link-tracker allows Stored |
| CVE-2025-62106 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM Sy |
| CVE-2025-62182 | Deferred | 未確認 | CWE-434 | Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious |
| CVE-2025-62193 | Deferred | 未確認 | CWE-78 | Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN com |
| CVE-2025-62224 | Analyzed | 未確認 | CWE-451 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network. |
| CVE-2025-62235 | Analyzed | 未確認 | CWE-290 | Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor. Th |
| CVE-2025-6225 | Deferred | 未確認 | CWE-78 | Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. The injected commands w |
| CVE-2025-62291 | Deferred | 未確認 | CWE-191 | In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow |
| CVE-2025-62327 | Analyzed | 未確認 | CWE-522 | In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries |
| CVE-2025-62348 | Deferred | 未確認 | CWE-94 | Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution und |
| CVE-2025-62349 | Deferred | 未確認 | CWE-287 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request pay |
| CVE-2025-62487 | Deferred | 未確認 | CWE-863 | On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was t |
| CVE-2025-62514 | Analyzed | 未確認 | CWE-1240, CWE-327 | Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec applicati |
| CVE-2025-62581 | Modified | 未確認 | CWE-321 | Delta Electronics DIAView has multiple vulnerabilities. |
| CVE-2025-62582 | Modified | 未確認 | CWE-306 | Delta Electronics DIAView has multiple vulnerabilities. |
| CVE-2025-62741 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Pool Services pool-services allows Server Side Request Forgery.This issue affects Pool Services: from n/a through |
| CVE-2025-62754 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2025-62840 | Analyzed | 未確認 | CWE-209 | A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they c |
| CVE-2025-62842 | Analyzed | 未確認 | CWE-73 | An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vu |
| CVE-2025-62852 | Analyzed | 未確認 | CWE-121, CWE-787 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the v |
| CVE-2025-62857 | Analyzed | 未確認 | CWE-79 | A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read applic |
| CVE-2025-62877 | Deferred | 未確認 | CWE-1188 | Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either cr |
| CVE-2025-63017 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes WerkStatt Plugin werkstatt-plugin allows PHP Loc |
| CVE-2025-63018 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in wproyal Bard bard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bard: from n/a through <= 2.229. |
| CVE-2025-63019 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embe |
| CVE-2025-63026 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-eleme |
| CVE-2025-63051 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue |
| CVE-2025-63082 | Analyzed | 未確認 | CWE-79 | Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. |
| CVE-2025-63083 | Analyzed | 未確認 | CWE-79 | Lack of output escaping leads to a XSS vector in the pagebreak plugin. |
| CVE-2025-63314 | Modified | 未確認 | CWE-640 | A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full accoun |
| CVE-2025-63611 | Analyzed | 未確認 | CWE-79 | Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendere |
| CVE-2025-63644 | Analyzed | 未確認 | CWE-79 | A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field. |
| CVE-2025-63647 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted D |
| CVE-2025-63648 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via |
| CVE-2025-63649 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS |
| CVE-2025-63650 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP |
| CVE-2025-63651 | Analyzed | 未確認 | CWE-416 | A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP |
| CVE-2025-63652 | Analyzed | 未確認 | CWE-416 | A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP r |
| CVE-2025-63653 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted H |
| CVE-2025-63655 | Analyzed | 未確認 | CWE-476 | A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a craf |
| CVE-2025-63656 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTT |
| CVE-2025-63657 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted |
| CVE-2025-63658 | Analyzed | 未確認 | CWE-121 | A stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP |
| CVE-2025-64087 | Analyzed | 未確認 | CWE-1336 | A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting |
| CVE-2025-64090 | Analyzed | 未確認 | CWE-77 | This vulnerability allows authenticated attackers to execute commands via the hostname of the device. |
| CVE-2025-64091 | Analyzed | 未確認 | CWE-78 | This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device. |
| CVE-2025-64092 | Analyzed | 未確認 | CWE-89 | This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database. |
| CVE-2025-64093 | Analyzed | 未確認 | CWE-77 | Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device. |
| CVE-2025-64097 | Analyzed | 未確認 | CWE-330 | NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to v |
| CVE-2025-64119 | Deferred | 未確認 | CWE-603 | A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9. |
| CVE-2025-64120 | Analyzed | 未確認 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection |
| CVE-2025-64121 | Analyzed | 未確認 | CWE-288 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack C |
| CVE-2025-64122 | Analyzed | 未確認 | CWE-522 | Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller |
| CVE-2025-64123 | Analyzed | 未確認 | CWE-441 | Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): thr |
| CVE-2025-64124 | Analyzed | 未確認 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection |
| CVE-2025-64125 | Deferred | 未確認 | CWE-441 | A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End |
| CVE-2025-64155 | Modified | 未確認 | CWE-78 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7. |
| CVE-2025-64252 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in Marco Milesi ANAC XML Viewer anac-xml-viewer allows Server Side Request Forgery.This issue affects ANAC XML Viewer: from n/a thr |
| CVE-2025-64305 | Deferred | 未確認 | CWE-313 | MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacker can utilize these plaintext secrets |
| CVE-2025-64419 | Analyzed | 未確認 | CWE-77 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are |
| CVE-2025-64420 | Analyzed | 未確認 | CWE-522 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users |
| CVE-2025-64421 | Analyzed | 未確認 | CWE-863 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user ( |
| CVE-2025-64422 | Analyzed | 未確認 | CWE-770 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises |
| CVE-2025-64423 | Analyzed | 未確認 | CWE-287 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user ( |
| CVE-2025-64424 | Analyzed | 未確認 | CWE-77 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vul |
| CVE-2025-64425 | Analyzed | 未確認 | CWE-644 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiat |
| CVE-2025-64516 | Analyzed | 未確認 | CWE-284, CWE-639 | GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If t |
| CVE-2025-6461 | Deferred | 未確認 | CWE-200 | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in |
| CVE-2025-64691 | Analyzed | 未確認 | CWE-94 | The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resu |
| CVE-2025-64729 | Analyzed | 未確認 | CWE-862 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privi |
| CVE-2025-64769 | Analyzed | 未確認 | CWE-319 | The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or data leakage in cert |
| CVE-2025-65090 | Analyzed | 未確認 | CWE-200 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users |
| CVE-2025-65091 | Analyzed | 未確認 | CWE-89 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) |
| CVE-2025-65098 | Analyzed | 未確認 | CWE-200, CWE-284, CWE-311, CWE-522, CWE-639, CWE-79, CWE-862 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim |
| CVE-2025-65110 | Analyzed | 未確認 | CWE-79 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting t |
| CVE-2025-65117 | Analyzed | 未確認 | CWE-676 | The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to |
| CVE-2025-65118 | Analyzed | 未確認 | CWE-427 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privile |
| CVE-2025-65125 | Analyzed | 未確認 | CWE-89 | SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive information. |
| CVE-2025-65212 | Analyzed | 未確認 | CWE-565 | An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker |
| CVE-2025-65264 | Analyzed | 未確認 | CWE-20 | The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a |
| CVE-2025-65328 | Analyzed | 未確認 | CWE-807 | Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain. An attacker can |
| CVE-2025-65349 | Analyzed | 未確認 | CWE-79 | A Stored Cross-Site Scripting (XSS) vulnerability in Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to execut |
| CVE-2025-65368 | Analyzed | 未確認 | CWE-79 | SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output. |
| CVE-2025-65396 | Modified | 未確認 | CWE-119, CWE-125, CWE-1274 | A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootl |
| CVE-2025-65397 | Modified | 未確認 | CWE-20, CWE-287 | An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to the d |
| CVE-2025-65482 | Analyzed | 未確認 | CWE-611 | An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file. |
| CVE-2025-65518 | Modified | 未確認 | CWE-400, CWE-606 | Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted requ |
| CVE-2025-65552 | Modified | 未確認 | CWE-294 | D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement rolling codes, message au |
| CVE-2025-65553 | Modified | 未確認 | CWE-294 | D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to |
| CVE-2025-65731 | Analyzed | 未確認 | CWE-306 | An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical access to the UART pins to execute arbitrary |
| CVE-2025-65783 | Modified | 未確認 | CWE-434 | An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code via uplo |
| CVE-2025-65784 | Modified | 未確認 | CWE-918 | Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' information via a crafte |
| CVE-2025-65805 | Analyzed | 未確認 | CWE-121 | OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentiall |
| CVE-2025-65886 | Modified | 未確認 | CWE-400 | A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes. |
| CVE-2025-65887 | Modified | 未確認 | CWE-369, CWE-639 | A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero. |
| CVE-2025-65888 | Modified | 未確認 | CWE-400 | A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value. |
| CVE-2025-65889 | Modified | 未確認 | CWE-400 | A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-65890 | Modified | 未確認 | CWE-400 | A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device inde |
| CVE-2025-65891 | Modified | 未確認 | CWE-400 | A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative de |
| CVE-2025-65922 | Deferred | 未確認 | CWE-1021 | PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modific |
| CVE-2025-66001 | Deferred | 未確認 | CWE-295 | NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is |
| CVE-2025-66002 | Deferred | 未確認 | CWE-88 | An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper |
| CVE-2025-66003 | Deferred | 未確認 | CWE-73 | An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents |
| CVE-2025-66005 | Deferred | 未確認 | CWE-863 | Lack of authorization of the InputManager D-Bus interface in InputPlumber versions before v0.63.0 can lead to local Denial-of-Service, information leak or even privilege escalation |
| CVE-2025-66023 | Analyzed | 未確認 | CWE-416 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client componen |
| CVE-2025-66049 | Analyzed | 未確認 | CWE-306 | Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 |
| CVE-2025-66050 | Analyzed | 未確認 | CWE-1393 | Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a pass |
| CVE-2025-66051 | Analyzed | 未確認 | CWE-22 | Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a |
| CVE-2025-66052 | Analyzed | 未確認 | CWE-78 | Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint is not sanitized prope |
| CVE-2025-66135 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Im |
| CVE-2025-66136 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ca |
| CVE-2025-66137 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect |
| CVE-2025-66138 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe |
| CVE-2025-66139 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Au |
| CVE-2025-66140 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper f |
| CVE-2025-66141 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a thr |
| CVE-2025-66142 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issu |
| CVE-2025-66143 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from |
| CVE-2025-66169 | Analyzed | 未確認 | CWE-89 | Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.1 |
| CVE-2025-66176 | Modified | 未確認 | CWE-121 | There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network ( |
| CVE-2025-66177 | Deferred | 未確認 | CWE-121 | There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (L |
| CVE-2025-66199 | Analyzed | 未確認 | CWE-789 | Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate |
| CVE-2025-66292 | Analyzed | 未確認 | CWE-22, CWE-73 | DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Auth |
| CVE-2025-66315 | Analyzed | 未確認 | CWE-269, CWE-863 | There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settings, an attacker can execute write permiss |
| CVE-2025-66376 | Analyzed | 掲載 | CWE-79 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. |
| CVE-2025-66398 | Analyzed | 未確認 | CWE-78, CWE-913 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath` |
| CVE-2025-66417 | Analyzed | 未確認 | CWE-89 | GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerabili |
| CVE-2025-66428 | Deferred | 未確認 | CWE-22, CWE-269 | An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation. |
| CVE-2025-66488 | Analyzed | 未確認 | CWE-116 | Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. Whil |
| CVE-2025-66518 | Analyzed | 未確認 | CWE-22, CWE-27 | Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not |
| CVE-2025-66523 | Analyzed | 未確認 | CWE-79 | URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an auth |
| CVE-2025-66560 | Analyzed | 未確認 | CWE-770 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer o |
| CVE-2025-66620 | Analyzed | 未確認 | CWE-553 | An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited |
| CVE-2025-66648 | Analyzed | 未確認 | CWE-79 | vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use |
| CVE-2025-66686 | Analyzed | 未確認 | CWE-79 | A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject malicious JavaScript code int |
| CVE-2025-66689 | Analyzed | 未確認 | CWE-22, CWE-552 | A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerability is caused by flawe |
| CVE-2025-66692 | Analyzed | 未確認 | CWE-126 | A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-66698 | Modified | 未確認 | CWE-287 | An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints. |
| CVE-2025-66715 | Analyzed | 未確認 | CWE-77 | A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4 allows attackers to execute arbitrary code via a crafted DLL file. |
| CVE-2025-66719 | Analyzed | 未確認 | CWE-863 | An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go b |
| CVE-2025-66720 | Analyzed | 未確認 | CWE-476 | Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId. |
| CVE-2025-66744 | Deferred | 未確認 | CWE-22 | In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive i |
| CVE-2025-66786 | Analyzed | 未確認 | CWE-20 | OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface t |
| CVE-2025-66802 | Analyzed | 未確認 | CWE-434 | Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receives a reverse shell (php) into imagem of the user enabling RCE |
| CVE-2025-66803 | Analyzed | 未確認 | CWE-362 | Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. |
| CVE-2025-66837 | Analyzed | 未確認 | CWE-434 | A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware |
| CVE-2025-66838 | Analyzed | 未確認 | CWE-770 | In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unrestricted rate. An at |
| CVE-2025-66902 | Analyzed | 未確認 | CWE-20 | An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive information or cause unexpected server behavior via the websocket_ser |
| CVE-2025-66913 | Analyzed | 未確認 | CWE-94 | JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to |
| CVE-2025-66916 | Analyzed | 未確認 | CWE-94 | The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter u |
| CVE-2025-66939 | Analyzed | 未確認 | CWE-79 | Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file |
| CVE-2025-66959 | Analyzed | 未確認 | CWE-20, CWE-400 | An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder |
| CVE-2025-66960 | Analyzed | 未確認 | CWE-20, CWE-400 | An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF meta |
| CVE-2025-67004 | Modified | 未確認 | CWE-22 | ** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the |
| CVE-2025-67025 | Analyzed | 未確認 | CWE-79 | Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment comment section |
| CVE-2025-67070 | Deferred | 未確認 | CWE-288 | A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-factor authentication (MFA) mechanism du |
| CVE-2025-67076 | Analyzed | 未確認 | CWE-22 | Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGet |
| CVE-2025-67077 | Analyzed | 未確認 | CWE-434 | File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action. |
| CVE-2025-67078 | Modified | 未確認 | CWE-79 | Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the file controller used t |
| CVE-2025-67079 | Analyzed | 未確認 | CWE-434 | File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file |
| CVE-2025-67081 | Analyzed | 未確認 | CWE-89 | An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue |
| CVE-2025-67082 | Analyzed | 未確認 | CWE-89 | An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker c |
| CVE-2025-67083 | Analyzed | 未確認 | CWE-22 | Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends |
| CVE-2025-67084 | Analyzed | 未確認 | CWE-616 | File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading |
| CVE-2025-67089 | Analyzed | 未確認 | CWE-77 | A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to |
| CVE-2025-67090 | Analyzed | 未確認 | CWE-307 | The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lacks rate limiting or ac |
| CVE-2025-67091 | Analyzed | 未確認 | CWE-307 | An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg |
| CVE-2025-67124 | Analyzed | 未確認 | CWE-367, CWE-59 | A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended uploa |
| CVE-2025-67125 | Analyzed | 未確認 | CWE-190 | A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONG_MAX + first user "-v/--verbose") can ca |
| CVE-2025-67133 | Modified | 未確認 | CWE-400 | An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component |
| CVE-2025-67146 | Analyzed | 未確認 | CWE-89 | Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_sear |
| CVE-2025-67147 | Deferred | 未確認 | CWE-89 | Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'user |
| CVE-2025-67158 | Modified | 未確認 | CWE-287 | An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and escalate privileges vi |
| CVE-2025-67159 | Modified | 未確認 | CWE-319 | Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. |
| CVE-2025-67160 | Modified | 未確認 | CWE-22 | An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. |
| CVE-2025-67221 | Analyzed | 未確認 | CWE-770 | The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents. |
| CVE-2025-67229 | Analyzed | 未確認 | CWE-295 | An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by ex |
| CVE-2025-6723 | Deferred | 未確認 | CWE-269, CWE-287 | Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connecti |
| CVE-2025-67230 | Analyzed | 未確認 | CWE-276 | Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers withou |
| CVE-2025-67231 | Analyzed | 未確認 | CWE-79 | A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payloa |
| CVE-2025-67246 | Modified | 未確認 | CWE-269, CWE-732 | A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver exposes a device interface |
| CVE-2025-67261 | Analyzed | 未確認 | CWE-89 | Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page. |
| CVE-2025-67263 | Analyzed | 未確認 | CWE-79 | Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properly sanitize user-suppl |
| CVE-2025-67264 | Modified | 未確認 | CWE-78 | An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local attacker to execute arbitrary code and esc |
| CVE-2025-67268 | Modified | 未確認 | CWE-122, CWE-1285 | gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 |
| CVE-2025-67269 | Modified | 未確認 | CWE-191 | An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing |
| CVE-2025-67274 | Analyzed | 未確認 | CWE-200 | An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-pe |
| CVE-2025-67278 | Analyzed | 未確認 | CWE-266 | An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request |
| CVE-2025-67279 | Analyzed | 未確認 | CWE-266 | An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format |
| CVE-2025-67280 | Analyzed | 未確認 | CWE-564 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and |
| CVE-2025-67281 | Analyzed | 未確認 | CWE-89 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content. |
| CVE-2025-67282 | Analyzed | 未確認 | CWE-288 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of other user, access wo |
| CVE-2025-67303 | Analyzed | 未確認 | CWE-420 | An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing it |
| CVE-2025-67315 | Rejected | 未確認 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: n | |
| CVE-2025-67316 | Modified | 未確認 | CWE-79 | An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser. NOTE: The supplier |
| CVE-2025-67325 | Analyzed | 未確認 | CWE-434 | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution. |
| CVE-2025-67364 | Analyzed | 未確認 | CWE-24 | fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper pat |
| CVE-2025-67366 | Analyzed | 未確認 | CWE-23 | @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability |
| CVE-2025-67397 | Analyzed | 未確認 | CWE-77 | An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection. |
| CVE-2025-67399 | Modified | 未確認 | CWE-200 | An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller (Wi-F |
| CVE-2025-67419 | Analyzed | 未確認 | CWE-1050 | A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The ap |
| CVE-2025-67427 | Analyzed | 未確認 | CWE-918 | A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET / |
| CVE-2025-67603 | Deferred | 未確認 | CWE-285 | A Improper Authorization vulnerability in Foomuuri llows arbitrary users to influence the firewall configuration.This issue affects Foomuuri: from ? before 0.31. |
| CVE-2025-67614 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: fro |
| CVE-2025-67615 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This |
| CVE-2025-67616 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This i |
| CVE-2025-67617 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3. |
| CVE-2025-67619 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2. |
| CVE-2025-67620 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CleverSoft Anon anon2x allows Reflected XSS.This issue affects Anon: from n/a |
| CVE-2025-67626 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search: from n/a through <= 1 |
| CVE-2025-67645 | Analyzed | 未確認 | CWE-284 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit en |
| CVE-2025-67647 | Analyzed | 未確認 | CWE-248, CWE-918 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) a |
| CVE-2025-67652 | Deferred | 未確認 | CWE-261 | An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The |
| CVE-2025-67683 | Analyzed | 未確認 | CWE-79 | Quick.Cart is vulnerable to reflected XSS via the sSort parameter. An attacker can craft a malicious URL which, when opened, results in arbitrary JavaScript execution in the victim |
| CVE-2025-67684 | Analyzed | 未確認 | CWE-22 | Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents w |
| CVE-2025-67685 | Analyzed | 未確認 | CWE-918 | A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all version |
| CVE-2025-67723 | Analyzed | 未確認 | CWE-79 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerabi |
| CVE-2025-67732 | Analyzed | 未確認 | CWE-200, CWE-522 | Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator users to view and reus |
| CVE-2025-67810 | Analyzed | 未確認 | CWE-125 | In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fix |
| CVE-2025-67811 | Analyzed | 未確認 | CWE-89 | Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary S |
| CVE-2025-67813 | Analyzed | 未確認 | CWE-276 | Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication |
| CVE-2025-67822 | Analyzed | 未確認 | CWE-287 | A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacker to conduct an au |
| CVE-2025-67823 | Analyzed | 未確認 | CWE-79 | A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to condu |
| CVE-2025-67824 | Deferred | 未確認 | CWE-79 | The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS |
| CVE-2025-67825 | Modified | 未確認 | CWE-346 | An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it displays signer information from a non-verified PDF field rather than from the verified |
| CVE-2025-67833 | Analyzed | 未確認 | CWE-79 | Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter. |
| CVE-2025-67834 | Analyzed | 未確認 | CWE-79 | Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter. |
| CVE-2025-67835 | Analyzed | 未確認 | CWE-400 | Paessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service (DoS) by an authenticated attacker via the Notification Contacts functionality. |
| CVE-2025-67847 | Analyzed | 未確認 | CWE-94 | A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restor |
| CVE-2025-67858 | Deferred | 未確認 | CWE-88 | A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating th |
| CVE-2025-67859 | Deferred | 未確認 | CWE-287 | A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from |
| CVE-2025-67910 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudi |
| CVE-2025-67911 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11. |
| CVE-2025-67913 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Aruba |
| CVE-2025-67914 | Deferred | 未確認 | CWE-35 | Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8. |
| CVE-2025-67915 | Deferred | 未確認 | CWE-288 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1 |
| CVE-2025-67916 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from |
| CVE-2025-67917 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a th |
| CVE-2025-67918 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: fro |
| CVE-2025-67919 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This i |
| CVE-2025-67920 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File In |
| CVE-2025-67921 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n |
| CVE-2025-67922 | Modified | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue af |
| CVE-2025-67923 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEng |
| CVE-2025-67924 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload a Web Shell to a Web Server.This issue affects Corpkit: from n/a through < |
| CVE-2025-67925 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Corpkit corpkit allows PHP Local File Inclusion. |
| CVE-2025-67926 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flue |
| CVE-2025-67927 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue af |
| CVE-2025-67928 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issu |
| CVE-2025-67930 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vernon Systems Limited eHive Search ehive-search allows Reflected XSS.This iss |
| CVE-2025-67931 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.This issue affects Bulle |
| CVE-2025-67932 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Lis |
| CVE-2025-67933 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS.This issue affects Ta |
| CVE-2025-67934 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wellspring wellspring allows PHP Local File I |
| CVE-2025-67935 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Optimize optimizewp allows PHP Local File Inc |
| CVE-2025-67936 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly curly allows PHP Local File Inclusion.T |
| CVE-2025-67937 | Modified | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Hendon hendon allows PHP Local File Inclusion |
| CVE-2025-67938 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File Inc |
| CVE-2025-67939 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tic |
| CVE-2025-67940 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inc |
| CVE-2025-67941 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File Incl |
| CVE-2025-67942 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This i |
| CVE-2025-67943 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected |
| CVE-2025-67944 | Deferred | 未確認 | CWE-94 | Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testin |
| CVE-2025-67945 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Inje |
| CVE-2025-67946 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclu |
| CVE-2025-67947 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle AdForest Elementor adforest-elementor allows Reflected XSS.This |
| CVE-2025-67949 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko |
| CVE-2025-67952 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand |
| CVE-2025-67953 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: fro |
| CVE-2025-67954 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensit |
| CVE-2025-67955 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File In |
| CVE-2025-67956 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User |
| CVE-2025-67957 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File |
| CVE-2025-67958 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2025-67959 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkSco |
| CVE-2025-67960 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affec |
| CVE-2025-67961 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0. |
| CVE-2025-67963 | Deferred | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie |
| CVE-2025-67964 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey |
| CVE-2025-67966 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3 |
| CVE-2025-67967 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer |
| CVE-2025-67968 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a |
| CVE-2025-68001 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: |
| CVE-2025-68003 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show |
| CVE-2025-68004 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affec |
| CVE-2025-68006 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking |
| CVE-2025-68007 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2025-68008 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: |
| CVE-2025-68009 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Template |
| CVE-2025-68010 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a |
| CVE-2025-68011 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GLS GLS Shipping for WooCommerce gls-shipping-for-woocommerce allows Reflected |
| CVE-2025-68012 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects |
| CVE-2025-68013 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Contro |
| CVE-2025-68014 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects AweBooking: from n/a t |
| CVE-2025-68015 | Deferred | 未確認 | CWE-94 | Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This |
| CVE-2025-68016 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Acces |
| CVE-2025-68017 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injec |
| CVE-2025-68018 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff |
| CVE-2025-68019 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: |
| CVE-2025-68020 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a th |
| CVE-2025-68027 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32. |
| CVE-2025-68029 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedded Sensitive Data.Thi |
| CVE-2025-68030 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in WP Messiah Frontis Blocks frontis-blocks allows Server Side Request Forgery.This issue affects Frontis Blocks: from n/a through |
| CVE-2025-68033 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.This issue affects Custo |
| CVE-2025-68034 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue af |
| CVE-2025-68035 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: |
| CVE-2025-68039 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: |
| CVE-2025-68041 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issu |
| CVE-2025-68044 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Acce |
| CVE-2025-68046 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve E |
| CVE-2025-68047 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3. |
| CVE-2025-68057 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This is |
| CVE-2025-68058 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af |
| CVE-2025-68059 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listin |
| CVE-2025-68072 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2025-68073 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This is |
| CVE-2025-68119 | Analyzed | 未確認 | CWE-787 | Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sour |
| CVE-2025-68132 | Analyzed | 未確認 | CWE-125 | EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermeter SLIP parser reads `vec[vec.size()-1]` and `vec[vec.size() |
| CVE-2025-68133 | Analyzed | 未確認 | CWE-770 | EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an u |
| CVE-2025-68134 | Analyzed | 未確認 | CWE-20 | EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors frequently causes the module to crash. This is particularly |
| CVE-2025-68135 | Analyzed | 未確認 | CWE-703 | EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by the `TbdController` loop, leading to its caller and itself |
| CVE-2025-68136 | Analyzed | 未確認 | CWE-770 | EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` wh |
| CVE-2025-68137 | Analyzed | 未確認 | CWE-120, CWE-835 | EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 a |
| CVE-2025-68138 | Analyzed | 未確認 | CWE-770 | EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by th |
| CVE-2025-68139 | Analyzed | 未確認 | CWE-384 | EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `False`, which leaves th |
| CVE-2025-68140 | Analyzed | 未確認 | CWE-863 | EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID |
| CVE-2025-68141 | Analyzed | 未確認 | CWE-476 | EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receipt as well as TaxCosts, the vect |
| CVE-2025-68151 | Analyzed | 未確認 | CWE-770 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An |
| CVE-2025-68158 | Modified | 未確認 | CWE-352 | Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating u |
| CVE-2025-68160 | Modified | 未確認 | CWE-787 | Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds wri |
| CVE-2025-68271 | Deferred | 未確認 | CWE-95 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remo |
| CVE-2025-68272 | Analyzed | 未確認 | CWE-400, CWE-770 | Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker |
| CVE-2025-68273 | Analyzed | 未確認 | CWE-200 | Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to |
| CVE-2025-68276 | Analyzed | 未確認 | CWE-617 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-dae |
| CVE-2025-68280 | Analyzed | 未確認 | CWE-611 | Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file r |
| CVE-2025-68428 | Modified | 未確認 | CWE-22, CWE-35, CWE-73 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusio |
| CVE-2025-68436 | Analyzed | 未確認 | CWE-200 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentia |
| CVE-2025-68437 | Analyzed | 未確認 | CWE-918 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeName>_Asset` mutation i |
| CVE-2025-68438 | Analyzed | 未確認 | CWE-200 | In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rend |
| CVE-2025-68454 | Analyzed | 未確認 | CWE-1336 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Executio |
| CVE-2025-68455 | Analyzed | 未確認 | CWE-470 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Executio |
| CVE-2025-68456 | Analyzed | 未確認 | CWE-202, CWE-770 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations |
| CVE-2025-68468 | Analyzed | 未確認 | CWE-617 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolici |
| CVE-2025-68470 | Analyzed | 未確認 | CWE-601 | React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navig |
| CVE-2025-68471 | Analyzed | 未確認 | CWE-617 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsoli |
| CVE-2025-68472 | Modified | 未確認 | CWE-22, CWE-23, CWE-36 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller |
| CVE-2025-68479 | Analyzed | 未確認 | CWE-862 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership befo |
| CVE-2025-68492 | Deferred | 未確認 | CWE-639 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread owne |
| CVE-2025-68493 | Modified | 未確認 | CWE-112, CWE-611 | Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users ar |
| CVE-2025-68507 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through |
| CVE-2025-68510 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File In |
| CVE-2025-68518 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: |
| CVE-2025-68520 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: fr |
| CVE-2025-68538 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: fr |
| CVE-2025-68547 | Modified | 未確認 | CWE-862 | Missing Authorization vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Foll |
| CVE-2025-68558 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: f |
| CVE-2025-68609 | Deferred | 未確認 | CWE-305 | A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect r |
| CVE-2025-68616 | Modified | 未確認 | CWE-601, CWE-918 | WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. |
| CVE-2025-68619 | Analyzed | 未確認 | CWE-94 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages throug |
| CVE-2025-68620 | Analyzed | 未確認 | CWE-288 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication |
| CVE-2025-68622 | Analyzed | 未確認 | CWE-121 | Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB V |
| CVE-2025-68637 | Analyzed | 未確認 | CWE-297 | The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication b |
| CVE-2025-68656 | Analyzed | 未確認 | CWE-416 | Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descriptor() frees and reallocates hid_device->ct |
| CVE-2025-68657 | Analyzed | 未確認 | CWE-415, CWE-667 | Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice |
| CVE-2025-68658 | Analyzed | 未確認 | CWE-79 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 has a stored XSS vulner |
| CVE-2025-68659 | Analyzed | 未確認 | CWE-770 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the usernam |
| CVE-2025-68660 | Analyzed | 未確認 | CWE-863 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass the ai_discover_pers |
| CVE-2025-68662 | Analyzed | 未確認 | CWE-918 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassi |
| CVE-2025-68666 | Analyzed | 未確認 | CWE-863 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges eve |
| CVE-2025-68670 | Analyzed | 未確認 | CWE-121, CWE-787 | xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when pro |
| CVE-2025-68671 | Analyzed | 未確認 | CWE-294 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing repl |
| CVE-2025-68675 | Modified | 未確認 | CWE-532 | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fi |
| CVE-2025-68698 | Analyzed | 未確認 | CWE-327 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle a |
| CVE-2025-68701 | Analyzed | 未確認 | CWE-327, CWE-340 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerabilit |
| CVE-2025-68702 | Analyzed | 未確認 | CWE-327 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it should use padLeft(64, '0') because SHA-25 |
| CVE-2025-68703 | Analyzed | 未確認 | CWE-326 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with t |
| CVE-2025-68704 | Analyzed | 未確認 | CWE-330 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing |
| CVE-2025-68705 | Analyzed | 未確認 | CWE-22 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_fi |
| CVE-2025-68707 | Analyzed | 未確認 | CWE-288 | An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration |
| CVE-2025-68715 | Analyzed | 未確認 | CWE-306 | An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/setLan, /goform/wirelessBasic) that do not |
| CVE-2025-68716 | Analyzed | 未確認 | CWE-284, CWE-306, CWE-521 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators |
| CVE-2025-68717 | Analyzed | 未確認 | CWE-287 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unau |
| CVE-2025-68718 | Analyzed | 未確認 | CWE-200 | KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:12345678). The administrator cannot disable the |
| CVE-2025-68719 | Analyzed | 未確認 | CWE-200, CWE-552 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and maintains an active session, an attacker can directly query the |
| CVE-2025-68751 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is detected when running | |
| CVE-2025-68752 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime | |
| CVE-2025-68753 | Deferred | 未確認 | CWE-787 | In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event handling code, a put_us |
| CVE-2025-68754 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically | |
| CVE-2025-68755 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: staging: most: remove broken i2c driver The MOST I2C driver has been completely broken for five years without | |
| CVE-2025-68756 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() f | |
| CVE-2025-68757 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 second | |
| CVE-2025-68758 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devic | |
| CVE-2025-68759 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ring(), memory is alloc | |
| CVE-2025-68760 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it validates the user-pr | |
| CVE-2025-68761 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix potential use after free in hfs_correct_next_unused_CNID() This code calls hfs_bnode_put(node) which | |
| CVE-2025-68762 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when netconsole setup fails o | |
| CVE-2025-68763 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assign | |
| CVE-2025-68764 | Deferred | 未確認 | CWE-862 | In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, |
| CVE-2025-68765 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is alloca | |
| CVE-2025-68766 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to | |
| CVE-2025-68767 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can be | |
| CVE-2025-68768 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: flush pending skbs in fqdir_pre_exit() We have been seeing occasional deadlocks on pernet_ops_rws | |
| CVE-2025-68769 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fs_recover_fsync_data() With below scripts, it will trigger panic in f2fs: mkfs.f | |
| CVE-2025-68770 | Deferred | 未確認 | CWE-667 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix XDP_TX path For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not correct. __bn |
| CVE-2025-68771 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2_find_victim_chain syzbot reported a kernel BUG in ocfs2_find_victim_chain() bec | |
| CVE-2025-68772 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng <[email protected]> reported a | |
| CVE-2025-68773 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 b | |
| CVE-2025-68774 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, bot | |
| CVE-2025-68775 | Deferred | 未確認 | CWE-662 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is remov |
| CVE-2025-68776 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() | |
| CVE-2025-68777 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation The current validation 'wire_order[i] > A | |
| CVE-2025-68778 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting i | |
| CVE-2025-68779 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister m | |
| CVE-2025-68780 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set free_cpus for online runqueues Commit 16b269436b72 ("sched/deadline: Modify cpudl::fr | |
| CVE-2025-68781 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is | |
| CVE-2025-68782 | Deferred | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset t_task_cdb pointer in error case If allocation of cmd->t_task_cdb fails, it remains NULL b |
| CVE-2025-68783 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter p | |
| CVE-2025-68784 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix a UAF problem in xattr repair The xchk_setup_xattr_buf function can allocate a new value buffer, whic | |
| CVE-2025-68785 | Deferred | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in push_nsh() action The push_nsh() action structure looks l |
| CVE-2025-68786 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (inc | |
| CVE-2025-68787 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory leak [1]. When function sock_alloc_send_skb( | |
| CVE-2025-68788 | Deferred | 未確認 | CWE-200 | In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users |
| CVE-2025-68789 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2025-68790 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after un | |
| CVE-2025-68791 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload | |
| CVE-2025-68792 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just | |
| CVE-2025-68793 | Deferred | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix a job->pasid access race in gpu recovery Avoid a possible UAF in GPU recovery due to a race be |
| CVE-2025-68794 | Deferred | 未確認 | CWE-190 | In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_range() assumes that the |
| CVE-2025-68795 | Deferred | 未確認 | CWE-122 | In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl |
| CVE-2025-68796 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_e | |
| CVE-2025-68797 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: char: applicom: fix NULL pointer dereference in ac_ioctl Discovered by Atuin - Automated Vulnerability Discove | |
| CVE-2025-68798 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Check event before enable to avoid GPF On AMD machines cpuc->events[idx] can become NULL in a su | |
| CVE-2025-68799 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: caif: fix integer underflow in cffrml_receive() The cffrml_receive() function extracts a length field from the | |
| CVE-2025-68800 | Deferred | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mute |
| CVE-2025-68801 | Deferred | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix neighbour use-after-free We sometimes observe use-after-free when dereferencing a |
| CVE-2025-68802 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Limit num_syncs to prevent oversized allocations The exec and vm_bind ioctl allow userspace to specify | |
| CVE-2025-68803 | Deferred | 未確認 | CWE-863 | In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting ACL An NFSv4 client that sets an ACL with a named principal during |
| CVE-2025-68804 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread `cr | |
| CVE-2025-68805 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: fuse: fix io-uring list corruption for terminated non-committed requests When a request is terminated before i | |
| CVE-2025-68806 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix buffer validation by including null terminator size in EA length The smb2_set_ea function, which ha | |
| CVE-2025-68807 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: block: fix race between wbt_enable_default and IO submission When wbt_enable_default() is moved out of queue f | |
| CVE-2025-68808 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: media: vidtv: initialize local pointers upon transfer of memory ownership vidtv_channel_si_init() creates a te | |
| CVE-2025-68809 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ksmbd | |
| CVE-2025-68810 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot Reject attempts to disable KVM_MEM_GUEST_MEM | |
| CVE-2025-68811 | Deferred | 未確認 | CWE-787 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the |
| CVE-2025-68812 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2025-68813 | Deferred | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_fa |
| CVE-2025-68814 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix filename leak in __io_openat_prep() __io_openat_prep() allocates a struct filename using getnam | |
| CVE-2025-68815 | Deferred | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Remove drr class from the active list if it changes to strict Whenever a user issues an ets qd |
| CVE-2025-68816 | Deferred | 未確認 | CWE-134 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firm |
| CVE-2025-68817 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connectio |
| CVE-2025-68818 | Deferred | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b08 |
| CVE-2025-68819 | Deferred | 未確認 | CWE-787 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() rlen value is a user-controlled value, but dtv |
| CVE-2025-68820 | Deferred | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4_raw_inode() If ext4_get_inode_loc() fails (e.g. if it returns -EFS |
| CVE-2025-68821 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is | |
| CVE-2025-68822 | Deferred | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: Input: alps - fix use-after-free bugs caused by dev3_register_work The dev3_register_work delayed work item is |
| CVE-2025-68823 | Modified | 未確認 | CWE-667 | In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., |
| CVE-2025-68835 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matiskiba Ravpage ravpage allows Reflected XSS.This issue affects Ravpage: fro |
| CVE-2025-68838 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress |
| CVE-2025-68839 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Theme Options easy-theme-options allows Reflected XSS.This is |
| CVE-2025-68849 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank Corso Quote Master quote-master allows Reflected XSS.This issue affects |
| CVE-2025-68850 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sell Down |
| CVE-2025-68857 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue |
| CVE-2025-68858 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Casey Bisson wpCAS wpcas allows Reflected XSS.This issue affects wpCAS: from n |
| CVE-2025-68859 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agmorpheus Syntax Highlighter Compress syntax-highlighter-compress allows Refl |
| CVE-2025-68864 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Stored XSS.This issue affects |
| CVE-2025-68865 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affec |
| CVE-2025-68866 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofer696 Dinatur dinatur allows Stored XSS.This issue affects Dinatur: from n |
| CVE-2025-68867 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affe |
| CVE-2025-68869 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a throug |
| CVE-2025-68871 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noCreativity Dooodl dooodl allows Reflected XSS.This issue affects Dooodl: fro |
| CVE-2025-68873 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chloédigital PRIMER by chloédigital primer-by-chloedigital allows Reflected XS |
| CVE-2025-68874 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows Reflected XSS.This i |
| CVE-2025-68875 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset allows Stored XSS.Thi |
| CVE-2025-68881 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.This issue affects AppEx |
| CVE-2025-68882 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Scalenut Scalenut scalenut allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scalenut: from n/a thro |
| CVE-2025-68883 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Reflected |
| CVE-2025-68884 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Simple Redirect wp-simple-redirect allows Reflected XSS.This issue |
| CVE-2025-68887 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-busin |
| CVE-2025-68889 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue affects Pinpoll: from |
| CVE-2025-68890 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This issue affects e-shops: |
| CVE-2025-68891 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.This issue affects WP A |
| CVE-2025-68892 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in [email protected] Scroll rss excerpt scroll-rss-excerpt allows Reflected XS |
| CVE-2025-68894 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shoutoutglobal ShoutOut shoutout allows Reflected XSS.This issue affects Shout |
| CVE-2025-68896 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One P |
| CVE-2025-68898 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XS |
| CVE-2025-68899 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4. |
| CVE-2025-68900 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS. This issue affects Enfold: from n/a throu |
| CVE-2025-68901 | Deferred | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a thr |
| CVE-2025-68902 | Deferred | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a thr |
| CVE-2025-68903 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0. |
| CVE-2025-68904 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Frontend Submit jnews-frontend-submit allows Reflected XSS.Th |
| CVE-2025-68905 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows PHP Loc |
| CVE-2025-68906 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Video jnews-video allows Reflected XSS.This issue affects JNe |
| CVE-2025-68907 | Deferred | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: f |
| CVE-2025-68908 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in temash Barberry barberry allows PHP Local File Inclusion.Th |
| CVE-2025-68909 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogistic blogistic allows Using Malicious Files.This issue affects Blogistic: from n/a through <= 1.0. |
| CVE-2025-68910 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects Blogzee: from n/a through <= 1.0.5. |
| CVE-2025-68911 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in solacewp Solace solace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Solace: from n/a through <= |
| CVE-2025-68912 | Deferred | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: fr |
| CVE-2025-68913 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Miion miion allows PHP Local File Inclusion.This |
| CVE-2025-68921 | Analyzed | 未確認 | CWE-22 | SteelSeries Nahimic 3 1.10.7 allows Directory traversal. |
| CVE-2025-68924 | Analyzed | 未確認 | CWE-829 | In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution. |
| CVE-2025-68925 | Analyzed | 未確認 | CWE-347 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies "alg":"RS256". This vuln |
| CVE-2025-68931 | Analyzed | 未確認 | CWE-287, CWE-327 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulnerable to padding oracl |
| CVE-2025-68933 | Analyzed | 未確認 | CWE-863 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` se |
| CVE-2025-68934 | Analyzed | 未確認 | CWE-770 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json tha |
| CVE-2025-68947 | Deferred | 未確認 | CWE-862 | NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing |
| CVE-2025-68949 | Analyzed | 未確認 | CWE-134, CWE-284 | n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching instead of exact IP co |
| CVE-2025-68953 | Analyzed | 未確認 | CWE-22 | Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary fi |
| CVE-2025-68954 | Analyzed | 未確認 | CWE-613 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or h |
| CVE-2025-68955 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68956 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68957 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68958 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68959 | Analyzed | 未確認 | CWE-200 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-68960 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68961 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68962 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68963 | Analyzed | 未確認 | CWE-521 | Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-68964 | Analyzed | 未確認 | CWE-20 | Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68965 | Analyzed | 未確認 | CWE-200 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-68966 | Analyzed | 未確認 | CWE-200 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-68967 | Analyzed | 未確認 | CWE-264 | Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-68968 | Analyzed | 未確認 | CWE-415 | Double free vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect the input function. |
| CVE-2025-68969 | Analyzed | 未確認 | CWE-362 | Multi-thread race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68970 | Analyzed | 未確認 | CWE-20 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-68986 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: from n/a through <= 1.2. |
| CVE-2025-68999 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQ |
| CVE-2025-69001 | Deferred | 未確認 | CWE-94 | Improper Control of Generation of Code ('Code Injection') vulnerability in Shahjahan Jewel FluentForm fluentform allows Code Injection.This issue affects FluentForm: from n/a throu |
| CVE-2025-69002 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9. |
| CVE-2025-69003 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes KenthaRadio qt-kentharadio allows Reflected XSS.This issue affect |
| CVE-2025-69004 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in XpeedStudio Bajaar - Highly Customizable WooCommerce WordPr |
| CVE-2025-69005 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Search & Go search-and-go allows PHP Local Fi |
| CVE-2025-69035 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a through <= 2 |
| CVE-2025-69036 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n/a through <= 16.4. |
| CVE-2025-69037 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This |
| CVE-2025-69038 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Hyori hyori allows PHP Local File Inclusion.This |
| CVE-2025-69039 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bailly bailly allows PHP Local File Inclusion.Th |
| CVE-2025-69040 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bfres bfres allows PHP Local File Inclusion.This |
| CVE-2025-69041 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Dekoro dekoro allows PHP Local File Inclusion.Th |
| CVE-2025-69042 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Lindo lindo allows PHP Local File Inclusion.This |
| CVE-2025-69043 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Rashy rashy allows PHP Local File Inclusion.This |
| CVE-2025-69044 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Vango vango allows PHP Local File Inclusion.This |
| CVE-2025-69045 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue |
| CVE-2025-69046 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab iRecco Core irecco-core allows PHP Local File |
| CVE-2025-69047 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech MaxShop sw_maxshop allows PHP Local File Inclusio |
| CVE-2025-69048 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XS |
| CVE-2025-69049 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Töbel tobel allows PHP Local File Inclusion.T |
| CVE-2025-69050 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclu |
| CVE-2025-69051 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This i |
| CVE-2025-69052 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorre |
| CVE-2025-69053 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XS |
| CVE-2025-69054 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Logos Showcase superlogoshowcase-wp allows Reflected XSS.This |
| CVE-2025-69055 | Deferred | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM C |
| CVE-2025-69056 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Hotel Listing hotel-listing allows Reflected XSS.This issue affects |
| CVE-2025-69057 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Eldon eldon allows PHP Local File Inclusion.Thi |
| CVE-2025-69058 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes PartyMaker partymaker allows PHP Local File In |
| CVE-2025-69059 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DiveIt diveit allows PHP Local File Inclusion. |
| CVE-2025-69060 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes uReach ureach allows PHP Local File Inclusion. |
| CVE-2025-69061 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MoveMe moveme allows PHP Local File Inclusion. |
| CVE-2025-69062 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Weedles weedles allows PHP Local File Inclusio |
| CVE-2025-69064 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pets Land petsland allows PHP Local File Inclu |
| CVE-2025-69065 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Snow Mountain snowmountain allows PHP Local Fi |
| CVE-2025-69066 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Indoor Plants indoor-plants allows PHP Local F |
| CVE-2025-69067 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tails tails allows PHP Local File Inclusion.Th |
| CVE-2025-69068 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Muji muji allows PHP Local File Inclusion.This |
| CVE-2025-69070 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tornados tornados allows PHP Local File Inclus |
| CVE-2025-69071 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes TanTum tantum allows PHP Local File Inclusion. |
| CVE-2025-69072 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP Local File Inclusion. |
| CVE-2025-69073 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Piqes piqes allows PHP Local File Inclusion.Th |
| CVE-2025-69074 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pearson Specter pearsonspecter allows PHP Loca |
| CVE-2025-69075 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Yolox yolox allows PHP Local File Inclusion.Th |
| CVE-2025-69076 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Modern Housewife modernhousewife allows PHP Lo |
| CVE-2025-69077 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hobo hobo allows PHP Local File Inclusion.This |
| CVE-2025-69078 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Malta malta allows PHP Local File Inclusion.Th |
| CVE-2025-69079 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instrumen |
| CVE-2025-69080 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This |
| CVE-2025-69081 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusi |
| CVE-2025-69082 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a throu |
| CVE-2025-69083 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Frappé frappe allows PHP Local File Inclusion |
| CVE-2025-69084 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issu |
| CVE-2025-69085 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue affects JobBank: fro |
| CVE-2025-69086 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Issabella issabella allows PHP Local File Inclusi |
| CVE-2025-69087 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent freeagent allows PHP Local File Inclusi |
| CVE-2025-69095 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe |
| CVE-2025-69097 | Deferred | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n |
| CVE-2025-69098 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWave Hide My WP hide_my_wp allows Reflected XSS.This issue affects Hide My W |
| CVE-2025-69099 | Deferred | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5. |
| CVE-2025-69100 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North north-wp allows PHP Local File Inclusion.T |
| CVE-2025-69101 | Deferred | 未確認 | CWE-288 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from |
| CVE-2025-69102 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue aff |
| CVE-2025-69169 | Deferred | 未確認 | CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflection Injection.This is |
| CVE-2025-69180 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This i |
| CVE-2025-69181 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer |
| CVE-2025-69182 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institutions Directory: from |
| CVE-2025-69183 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directo |
| CVE-2025-69184 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af |
| CVE-2025-69185 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listin |
| CVE-2025-69186 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This is |
| CVE-2025-69187 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n |
| CVE-2025-69188 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fitness- |
| CVE-2025-69190 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a thr |
| CVE-2025-69191 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingHub: from n |
| CVE-2025-69192 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Est |
| CVE-2025-69193 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membershi |
| CVE-2025-69194 | Analyzed | 未確認 | CWE-22 | A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An a |
| CVE-2025-69195 | Analyzed | 未確認 | CWE-121 | A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particula |
| CVE-2025-69197 | Analyzed | 未確認 | CWE-287, CWE-294 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled |
| CVE-2025-69198 | Analyzed | 未確認 | CWE-400, CWE-413, CWE-667 | Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocati |
| CVE-2025-69199 | Analyzed | 未確認 | CWE-400, CWE-770 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and |
| CVE-2025-69203 | Analyzed | 未確認 | CWE-290 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by |
| CVE-2025-69209 | Deferred | 未確認 | CWE-120 | ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stac |
| CVE-2025-69218 | Analyzed | 未確認 | CWE-863 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report which should b |
| CVE-2025-69220 | Analyzed | 未確認 | CWE-284, CWE-862 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authe |
| CVE-2025-69221 | Analyzed | 未確認 | CWE-284, CWE-862 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read |
| CVE-2025-69222 | Analyzed | 未確認 | CWE-918 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrictions of the Actions f |
| CVE-2025-69223 | Modified | 未確認 | CWE-409, CWE-770 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. A |
| CVE-2025-69224 | Analyzed | 未確認 | CWE-444 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the pr |
| CVE-2025-69225 | Analyzed | 未確認 | CWE-444 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the |
| CVE-2025-69226 | Analyzed | 未確認 | CWE-200, CWE-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components |
| CVE-2025-69227 | Analyzed | 未確認 | CWE-835 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, r |
| CVE-2025-69228 | Analyzed | 未確認 | CWE-770 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memor |
| CVE-2025-69229 | Analyzed | 未確認 | CWE-770 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usag |
| CVE-2025-69230 | Analyzed | 未確認 | CWE-779 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the c |
| CVE-2025-69255 | Analyzed | 未確認 | CWE-755 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed |
| CVE-2025-69258 | Analyzed | 未確認 | CWE-120, CWE-290, CWE-346 | A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execut |
| CVE-2025-69259 | Analyzed | 未確認 | CWE-120, CWE-346, CWE-476 | A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. |
| CVE-2025-69260 | Analyzed | 未確認 | CWE-120, CWE-125, CWE-346 | A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please no |
| CVE-2025-69262 | Analyzed | 未確認 | CWE-78, CWE-94 | pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with to |
| CVE-2025-69263 | Modified | 未確認 | CWE-494 | pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote ser |
| CVE-2025-69264 | Modified | 未確認 | CWE-693 | pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Depend |
| CVE-2025-69267 | Analyzed | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Path Traversal.This issue affects |
| CVE-2025-69268 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This |
| CVE-2025-69269 | Analyzed | 未確認 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows OS Command Injectio |
| CVE-2025-69270 | Analyzed | 未確認 | CWE-598 | Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue affects DX NetOps Spect |
| CVE-2025-69271 | Analyzed | 未確認 | CWE-522 | Insufficiently Protected Credentials vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 24.3.13 and earli |
| CVE-2025-69272 | Analyzed | 未確認 | CWE-319 | Cleartext Transmission of Sensitive Information vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 21.2.1 |
| CVE-2025-69273 | Analyzed | 未確認 | CWE-287 | Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3.10 and earlier. |
| CVE-2025-69274 | Analyzed | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects DX NetOps Spectrum: 2 |
| CVE-2025-69275 | Analyzed | 未確認 | CWE-79 | Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps Spectrum: 24.3.9 and |
| CVE-2025-69276 | Analyzed | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier. |
| CVE-2025-69284 | Analyzed | 未確認 | CWE-284 | Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane versio |
| CVE-2025-69285 | Analyzed | 未確認 | CWE-306 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in the /api/v1/datasource |
| CVE-2025-69289 | Analyzed | 未確認 | CWE-863 | Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to |
| CVE-2025-69290 | Rejected | 未確認 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2025. Notes: none | |
| CVE-2025-69291 | Rejected | 未確認 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2025. Notes: none | |
| CVE-2025-69292 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a through <= 1.6.4. |
| CVE-2025-69293 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <= 1.2.5. |
| CVE-2025-69300 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This |
| CVE-2025-69311 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstree |
| CVE-2025-69312 | Deferred | 未確認 | CWE-434 | Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.This issue affects Xpro |
| CVE-2025-69313 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through |
| CVE-2025-69314 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Werkstatt werkstatt allows PHP Local File Inclus |
| CVE-2025-69315 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.Th |
| CVE-2025-69316 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Reflected XSS.This issue affe |
| CVE-2025-69317 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: |
| CVE-2025-69318 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue affects JobWP: from n/ |
| CVE-2025-69319 | Deferred | 未確認 | CWE-94 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This issue affects Beaver |
| CVE-2025-69320 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affect |
| CVE-2025-69321 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Sp |
| CVE-2025-69327 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec |
| CVE-2025-69331 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theate |
| CVE-2025-69333 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/ |
| CVE-2025-69334 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS |
| CVE-2025-69335 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS.This issue affects T |
| CVE-2025-69336 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This |
| CVE-2025-69341 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control |
| CVE-2025-69342 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Calafate calafate allows PHP Local File Inclusion |
| CVE-2025-69344 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: |
| CVE-2025-69345 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This |
| CVE-2025-69346 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AffiliateX: from n/ |
| CVE-2025-69348 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Exploiting Incorrectly Configured Access Control Secur |
| CVE-2025-69349 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RSS |
| CVE-2025-69350 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accor |
| CVE-2025-69351 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issu |
| CVE-2025-69352 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2025-69353 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2025-69354 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issu |
| CVE-2025-69355 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tic |
| CVE-2025-69356 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-el |
| CVE-2025-69357 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor al |
| CVE-2025-69359 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from |
| CVE-2025-69360 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Ba |
| CVE-2025-69361 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Ex |
| CVE-2025-69362 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue affects UiChemy: from n/ |
| CVE-2025-69363 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security |
| CVE-2025-69364 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through < |
| CVE-2025-69412 | Deferred | 未確認 | CWE-295 | KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: |
| CVE-2025-69413 | Analyzed | 未確認 | CWE-204 | In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. |
| CVE-2025-69414 | Analyzed | 未確認 | CWE-863 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. |
| CVE-2025-69415 | Analyzed | 未確認 | CWE-672 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with |
| CVE-2025-69416 | Analyzed | 未確認 | CWE-863 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devic |
| CVE-2025-69417 | Analyzed | 未確認 | CWE-863 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endp |
| CVE-2025-69418 | Modified | 未確認 | CWE-325 | Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the |
| CVE-2025-69419 | Modified | 未確認 | CWE-787 | Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can tr |
| CVE-2025-69420 | Modified | 未確認 | CWE-754 | Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, caus |
| CVE-2025-69421 | Modified | 未確認 | CWE-476 | Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference |
| CVE-2025-69425 | Deferred | 未確認 | CWE-306, CWE-798 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this ser |
| CVE-2025-69426 | Deferred | 未確認 | CWE-732, CWE-798 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH |
| CVE-2025-69516 | Analyzed | 未確認 | CWE-1336 | A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, a |
| CVE-2025-69517 | Deferred | 未確認 | CWE-94 | An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creation of a new agent via |
| CVE-2025-69542 | Analyzed | 未確認 | CWE-77 | A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal processing logic where t |
| CVE-2025-69559 | Analyzed | 未確認 | CWE-434 | code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php. |
| CVE-2025-69562 | Analyzed | 未確認 | CWE-89 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter. |
| CVE-2025-69563 | Analyzed | 未確認 | CWE-89 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter. |
| CVE-2025-69564 | Analyzed | 未確認 | CWE-94 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_password, Role, Branch |
| CVE-2025-69565 | Analyzed | 未確認 | CWE-434 | code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php. |
| CVE-2025-69581 | Analyzed | 未確認 | CWE-524 | An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is |
| CVE-2025-69601 | Analyzed | 未確認 | CWE-22 | A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP archives are automatically extracted without va |
| CVE-2025-69602 | Analyzed | 未確認 | CWE-384 | A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful authentication. As a r |
| CVE-2025-69604 | Modified | 未確認 | CWE-276 | An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with r |
| CVE-2025-69612 | Modified | 未確認 | CWE-22 | A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. The "Download Template" function in the profile dashboard d |
| CVE-2025-69662 | Modified | 未確認 | CWE-89 | SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a Pos |
| CVE-2025-69749 | Analyzed | 未確認 | CWE-79 | Cross Site Scripting vulnerability in tale v.2.0.5 allows an attacker to execute arbitrary code. |
| CVE-2025-69762 | Analyzed | 未確認 | CWE-121 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execution. |
| CVE-2025-69763 | Analyzed | 未確認 | CWE-121 | Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the vlanId parameter, which can cause memory corruption and enable remote code execution. |
| CVE-2025-69764 | Analyzed | 未確認 | CWE-121 | Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the stbpvid stack buffer, which may result in memory |
| CVE-2025-69766 | Analyzed | 未確認 | CWE-121 | Tenda AX3 firmware v16.03.12.11 contains a stack-based buffer overflow in the formGetIptv function due to improper handling of the citytag stack buffer, which may result in memory |
| CVE-2025-69820 | Undergoing Analysis | 未確認 | CWE-22 | Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function. |
| CVE-2025-69821 | Analyzed | 未確認 | CWE-404 | An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connection |
| CVE-2025-69822 | Analyzed | 未確認 | CWE-200, CWE-284, CWE-287, CWE-294 | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafted deauth frame |
| CVE-2025-69828 | Deferred | 未確認 | CWE-434 | File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo upload in /Customer/A |
| CVE-2025-69907 | Deferred | 未確認 | CWE-284 | An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabinet API endpoint. A |
| CVE-2025-69908 | Analyzed | 未確認 | CWE-284 | An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a publicly accessible client-side JavaScript |
| CVE-2025-69929 | Modified | 未確認 | CWE-327 | An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over |
| CVE-2025-69990 | Analyzed | 未確認 | CWE-552 | phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted. |
| CVE-2025-69991 | Analyzed | 未確認 | CWE-89 | phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php. |
| CVE-2025-69992 | Analyzed | 未確認 | CWE-125 | phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication. |
| CVE-2025-7013 | Modified | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This issue affects Menu Pan |
| CVE-2025-7014 | Modified | 未確認 | CWE-384 | Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026. NOTE: The vendor was conta |
| CVE-2025-7015 | Modified | 未確認 | CWE-384 | Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12. |
| CVE-2025-7016 | Modified | 未確認 | CWE-284 | Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05 |
| CVE-2025-70161 | Analyzed | 未確認 | CWE-77 | EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without prope |
| CVE-2025-70298 | Analyzed | 未確認 | CWE-125 | GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function. |
| CVE-2025-70299 | Analyzed | 未確認 | CWE-122 | A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file. |
| CVE-2025-70302 | Analyzed | 未確認 | CWE-122 | A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-70303 | Analyzed | 未確認 | CWE-122 | A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. |
| CVE-2025-70304 | Analyzed | 未確認 | CWE-121 | A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. |
| CVE-2025-70305 | Analyzed | 未確認 | CWE-121 | A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file. |
| CVE-2025-70307 | Analyzed | 未確認 | CWE-121 | A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. |
| CVE-2025-70308 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file. |
| CVE-2025-70309 | Analyzed | 未確認 | CWE-121 | A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WAV file. |
| CVE-2025-70310 | Analyzed | 未確認 | CWE-122 | A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg file. |
| CVE-2025-70336 | Analyzed | 未確認 | CWE-79 | A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'S |
| CVE-2025-70368 | Analyzed | 未確認 | CWE-79 | Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text fie |
| CVE-2025-70457 | Analyzed | 未確認 | CWE-434 | A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly valida |
| CVE-2025-70458 | Analyzed | 未確認 | CWE-79 | A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerabil |
| CVE-2025-7048 | Deferred | 未確認 | CWE-805 | On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these p |
| CVE-2025-70644 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the time parameter of the sub_60CFC function. This vulnerability allows attackers to cause a Denial of Service |
| CVE-2025-70645 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetWifiMacFilterCfg function. This vulnerability allows attackers to cause |
| CVE-2025-70646 | Analyzed | 未確認 | CWE-121 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_72290 function. This vulnerability allows attackers to cause a Denial of Servi |
| CVE-2025-70648 | Analyzed | 未確認 | CWE-121 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_727F4 function. This vulnerability allows attackers to cause a Denial of Se |
| CVE-2025-70650 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. This vulnerability allows attackers to cause a De |
| CVE-2025-70651 | Analyzed | 未確認 | CWE-121 | Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a D |
| CVE-2025-70656 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the mac parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Service ( |
| CVE-2025-7072 | Deferred | 未確認 | CWE-798 | The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticated remote attacker co |
| CVE-2025-70744 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Ser |
| CVE-2025-70746 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of |
| CVE-2025-70747 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of S |
| CVE-2025-70753 | Analyzed | 未確認 | CWE-121, CWE-787 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers to cause a Denial of S |
| CVE-2025-70890 | Analyzed | 未確認 | CWE-79 | A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrary JavaScript code into the username para |
| CVE-2025-70891 | Analyzed | 未確認 | CWE-79 | A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module. The application does not properly saniti |
| CVE-2025-70892 | Analyzed | 未確認 | CWE-89 | Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in |
| CVE-2025-70893 | Analyzed | 未確認 | CWE-89 | A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fails to properly saniti |
| CVE-2025-70899 | Analyzed | 未確認 | CWE-352 | PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized actions on behalf of |
| CVE-2025-70968 | Analyzed | 未確認 | CWE-416 | FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE(). |
| CVE-2025-70974 | Deferred | 未確認 | CWE-829 | Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain pu |
| CVE-2025-70982 | Analyzed | 未確認 | CWE-284 | Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data. |
| CVE-2025-70983 | Analyzed | 未確認 | CWE-284, CWE-862 | Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges. |
| CVE-2025-70985 | Analyzed | 未確認 | CWE-284, CWE-862 | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope. |
| CVE-2025-70986 | Analyzed | 未確認 | CWE-284, CWE-862 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data. |
| CVE-2025-70999 | Modified | 未確認 | CWE-400 | A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID. |
| CVE-2025-71000 | Modified | 未確認 | CWE-400 | An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71001 | Modified | 未確認 | CWE-125 | A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71002 | Analyzed | 未確認 | CWE-369, CWE-681, CWE-704 | A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71003 | Analyzed | 未確認 | CWE-20 | An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71004 | Analyzed | 未確認 | CWE-125, CWE-476, CWE-787 | A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71005 | Analyzed | 未確認 | CWE-369 | A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71006 | Analyzed | 未確認 | CWE-369 | A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71007 | Analyzed | 未確認 | CWE-20 | An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
| CVE-2025-71008 | Analyzed | 未確認 | A segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Se | |
| CVE-2025-71009 | Analyzed | 未確認 | CWE-20 | An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted indices. |
| CVE-2025-71011 | Analyzed | 未確認 | CWE-20 | An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service |
| CVE-2025-71019 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C function. This vulnerability allows attackers to cause a Denial of Serv |
| CVE-2025-71020 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. This vulnerability allows attackers to cause a Denial of Serv |
| CVE-2025-71021 | Analyzed | 未確認 | CWE-121 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Se |
| CVE-2025-71023 | Analyzed | 未確認 | CWE-121 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Deni |
| CVE-2025-71024 | Analyzed | 未確認 | CWE-121, CWE-787 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to caus |
| CVE-2025-71025 | Analyzed | 未確認 | CWE-121, CWE-787 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause |
| CVE-2025-71026 | Analyzed | 未確認 | CWE-121, CWE-787 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a |
| CVE-2025-71027 | Analyzed | 未確認 | CWE-121, CWE-787 | Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a D |
| CVE-2025-71063 | Analyzed | 未確認 | CWE-295 | Errands before 46.2.10 does not verify TLS certificates for CalDAV servers. |
| CVE-2025-71064 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: using the num_tqps in the vf driver to apply for resources Currently, hdev->htqp is allocated using | |
| CVE-2025-71065 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock As Jiaming Zhang and syzbot reported, there is potential deadlock in f2f | |
| CVE-2025-71066 | Deferred | 未確認 | CWE-362 | In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trend |
| CVE-2025-71067 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ntfs: set dummy blocksize to read boot_block when mounting When mounting, sb->s_blocksize is used to read the | |
| CVE-2025-71068 | Modified | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpa |
| CVE-2025-71069 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: f2fs: invalidate dentry cache on failed whiteout creation F2FS can mount filesystems with corrupted directory | |
| CVE-2025-71070 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk server process releases a ublk char device f | |
| CVE-2025-71071 | Analyzed | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb d |
| CVE-2025-71072 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; sim | |
| CVE-2025-71073 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work |
| CVE-2025-71074 | Modified | 未確認 | CWE-362 | In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_d |
| CVE-2025-71075 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize wi |
| CVE-2025-71076 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, | |
| CVE-2025-71077 | Modified | 未確認 | CWE-20 | In the Linux kernel, the following vulnerability has been resolved: tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not cap any upper limit for the number of bank |
| CVE-2025-71078 | Modified | 未確認 | CWE-362 | In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software |
| CVE-2025-71079 | Modified | 未確認 | CWE-667 | In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unr |
| CVE-2025-71080 | Modified | 未確認 | CWE-617 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() ret |
| CVE-2025-71081 | Analyzed | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the |
| CVE-2025-71082 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_ |
| CVE-2025-71083 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Avoid NULL pointer deref for evicted BOs It is possible for a BO to exist that is not currently assoc |
| CVE-2025-71084 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multic |
| CVE-2025-71085 | Modified | 未確認 | CWE-190, CWE-617 | In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a B |
| CVE-2025-71086 | Modified | 未確認 | CWE-129 | In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_kill_by_device() collects sockets into a loca |
| CVE-2025-71087 | Modified | 未確認 | CWE-125, CWE-193 | In the Linux kernel, the following vulnerability has been resolved: iavf: fix off-by-one issues in iavf_config_rss_reg() There are off-by-one bugs when configuring RSS hash key a |
| CVE-2025-71088 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fallback earlier on simult connection Syzkaller reports a simult-connect race leading to inconsistent f | |
| CVE-2025-71089 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. |
| CVE-2025-71090 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() nfsd4_add_rdaccess_to_wrdeleg() uncondit | |
| CVE-2025-71091 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug rep |
| CVE-2025-71092 | Modified | 未確認 | CWE-787 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardw |
| CVE-2025-71093 | Modified | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame vi |
| CVE-2025-71094 | Modified | 未確認 | CWE-20 | In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via |
| CVE-2025-71095 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix the crash issue for zero copy XDP_TX action There is a crash issue when running zero copy XDP | |
| CVE-2025-71096 | Modified | 未確認 | CWE-457, CWE-908 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly The netlink response for RDMA_NL_LS_OP_IP_RESO |
| CVE-2025-71097 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix reference count leak when using error routes with nexthop objects When a nexthop object is deleted, |
| CVE-2025-71098 | Modified | 未確認 | CWE-119, CWE-476 | In the Linux kernel, the following vulnerability has been resolved: ip6_gre: make ip6gre_header() robust Over the years, syzbot found many ways to crash the kernel in ip6gre_head |
| CVE-2025-71099 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() In xe_oa_add_config_ioctl(), we accessed oa_config->i |
| CVE-2025-71100 | Modified | 未確認 | CWE-125, CWE-129 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() TID getting from ieee80211_get_tid() mig |
| CVE-2025-71101 | Modified | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_fr |
| CVE-2025-71102 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: scs: fix a wrong parameter in __scs_magic __scs_magic() needs a 'void *' variable, but a 'struct task_struct * | |
| CVE-2025-71103 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: adreno: fix deferencing ifpc_reglist when not declared On plaforms with an a7xx GPU not supporting IF |
| CVE-2025-71104 | Modified | 未確認 | CWE-400, CWE-667 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer When advancing the target expir |
| CVE-2025-71105 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: f2fs: use global inline_xattr_slab instead of per-sb slab cache As Hong Yun reported in mailing list: loop7: | |
| CVE-2025-71106 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: fs: PM: Fix reverse check in filesystems_freeze_callback() The freeze_all_ptr check in filesystems_freeze_call | |
| CVE-2025-71107 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: f2fs: ensure node page reads complete before f2fs_put_super() finishes Xfstests generic/335, generic/336 somet |
| CVE-2025-71108 | Modified | 未確認 | CWE-20 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect num_connectors capability The UCSI spec states that the num_connectors fiel |
| CVE-2025-71109 | Modified | 未確認 | CWE-787 | In the Linux kernel, the following vulnerability has been resolved: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Since commit e424054000878 ("MIPS: T |
| CVE-2025-71110 | Analyzed | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: mm/slub: reset KASAN tag in defer_free() before accessing freed memory When CONFIG_SLUB_TINY is enabled, kfree |
| CVE-2025-71111 | Modified | 未確認 | CWE-362, CWE-367 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments mu |
| CVE-2025-71112 | Modified | 未確認 | CWE-125, CWE-787 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without validation when rece |
| CVE-2025-71113 | Modified | 未確認 | CWE-119, CWE-908 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and reques |
| CVE-2025-71114 | Modified | 未確認 | CWE-20, CWE-401 | In the Linux kernel, the following vulnerability has been resolved: via_wdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses allocate_resou |
| CVE-2025-71115 | Analyzed | 未確認 | CWE-908 | In the Linux kernel, the following vulnerability has been resolved: um: init cpu_tasks[] earlier This is currently done in uml_finishsetup(), but e.g. with KCOV enabled we'll cra |
| CVE-2025-71116 | Modified | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted |
| CVE-2025-71117 | Analyzed | 未確認 | CWE-667 | In the Linux kernel, the following vulnerability has been resolved: block: Remove queue freezing from several sysfs store callbacks Freezing the request queue from inside sysfs s |
| CVE-2025-71118 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid walking the Namespace if start_node is NULL Although commit 0c9992315e73 ("ACPICA: Avoid walking |
| CVE-2025-71119 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec: Enable SMT before waking offline CPUs If SMT is disabled or a partial SMT state is enabled, whe | |
| CVE-2025-71120 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token |
| CVE-2025-71121 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the GSP chip and is used | |
| CVE-2025-71122 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED syzkaller found it could overflow math in t | |
| CVE-2025-71123 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix string copying in parse_apply_sb_mount_options() strscpy_pad() can't be used to copy a non-NUL-term | |
| CVE-2025-71124 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: move preempt_prepare_postamble after error check Move the call to preempt_prepare_postamble() af |
| CVE-2025-71125 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: tracing: Do not register unsupported perf events Synthetic events currently do not have a function to register |
| CVE-2025-71126 | Modified | 未確認 | CWE-362, CWE-667 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinjecting Jakub reported an MPTCP deadlock at fallback time: WARNI |
| CVE-2025-71127 | Modified | 未確認 | CWE-20 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the br |
| CVE-2025-71128 | Modified | 未確認 | CWE-665 | In the Linux kernel, the following vulnerability has been resolved: erspan: Initialize options_len before referencing options. The struct ip_tunnel_info has a flexible array memb |
| CVE-2025-71129 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they should follow LoongA | |
| CVE-2025-71130 | Modified | 未確認 | CWE-457, CWE-476 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer Initialize the eb.vma array with valu |
| CVE-2025-71131 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the und |
| CVE-2025-71132 | Modified | 未確認 | CWE-667 | In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occur |
| CVE-2025-71133 | Modified | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: avoid invalid read in irdma_net_event irdma_net_event() should not dereference anything from "neig |
| CVE-2025-71134 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: change all pageblocks migrate type on coalescing When a page is freed it coalesces with a buddy | |
| CVE-2025-71135 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() The variable mddev->private |
| CVE-2025-71136 | Modified | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() It's possible for cp_re |
| CVE-2025-71137 | Analyzed | 未確認 | CWE-787 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" This patch ensures that the RX ring size (rx_pending) is |
| CVE-2025-71138 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add missing NULL pointer check for pingpong interface It is checked almost always in dpu_encoder_ |
| CVE-2025-71139 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: kernel/kexec: fix IMA when allocation happens in CMA area *** Bug description *** When I tested kexec with th | |
| CVE-2025-71140 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Use spinlock for context list protection lock Previously a mutex was added to protect | |
| CVE-2025-71141 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: drm/tilcdc: Fix removal actions in case of failed probe The drm_kms_helper_poll_fini() and drm_atomic_helper_s | |
| CVE-2025-71142 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: cpuset: fix warning when disabling remote partition A warning was triggered as follows: WARNING: kernel/cgrou | |
| CVE-2025-71143 | Analyzed | 未確認 | CWE-129 | In the Linux kernel, the following vulnerability has been resolved: clk: samsung: exynos-clkout: Assign .num before accessing .hws Commit f316cdff8d67 ("clk: Annotate struct clk_ |
| CVE-2025-71144 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() After the blamed commit below, if the MPC subflow is already in TC | |
| CVE-2025-71145 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a U | |
| CVE-2025-71146 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix leaked ct in error paths There are some situations where ct might be leaked as er |
| CVE-2025-71147 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tp |
| CVE-2025-71148 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: restore destructor on submit failure handshake_req_submit() replaces sk->sk_destruct but never | |
| CVE-2025-71149 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2025-71150 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state | |
| CVE-2025-71151 | Analyzed | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb3_sync_session_ctx_pa |
| CVE-2025-71152 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: properly keep track of conduit reference Problem description ------------------- DSA has a mumbo-ju | |
| CVE-2025-71153 | Analyzed | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix memory leak in get_file_all_info() In get_file_all_info(), if vfs_getattr() fails, the function ret |
| CVE-2025-71154 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure In async_set_registers(), when usb_submit_urb() |
| CVE-2025-71155 | Modified | 未確認 | CWE-787 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gmap_helper_zap_one_page() again A few checks were missing in gmap_helper_zap_one_page(), which |
| CVE-2025-71156 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: gve: defer interrupt enabling until NAPI registration Currently, interrupts are automatically enabled immediat | |
| CVE-2025-71157 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() Since nldev_deldev() (introduced by comm | |
| CVE-2025-71158 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: ensure worker is torn down When an IRQ worker is running, unplugging the device would cause a cra | |
| CVE-2025-71159 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs_get_or_create_delaye |
| CVE-2025-71160 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nft_cha | |
| CVE-2025-71161 | Modified | 未確認 | CWE-193, CWE-400 | In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1 |
| CVE-2025-71162 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio stre |
| CVE-2025-71163 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix device leaks on compat bind and unbind Make sure to drop the reference taken when looking |
| CVE-2025-71164 | Analyzed | 未確認 | CWE-79 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] i |
| CVE-2025-71165 | Analyzed | 未確認 | CWE-79 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. |
| CVE-2025-71166 | Analyzed | 未確認 | CWE-79 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message ha |
| CVE-2025-71176 | Deferred | 未確認 | CWE-379 | pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges. |
| CVE-2025-71177 | Analyzed | 未確認 | CWE-79 | LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can suppl |
| CVE-2025-71178 | Deferred | 未確認 | CWE-427 | Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and l |
| CVE-2025-71180 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: counter: interrupt-cnt: Drop IRQF_NO_THREAD flag An IRQ handler can either be IRQF_NO_THREAD or acquire spinlo | |
| CVE-2025-71181 | Analyzed | 未確認 | CWE-667 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: remove spin_lock() in rust_shrink_free_page() When forward-porting Rust Binder to 6.18, I neglect |
| CVE-2025-71182 | Modified | 未確認 | CWE-362 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting |
| CVE-2025-71183 | Modified | 未確認 | CWE-362 | In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (either with the renam |
| CVE-2025-71184 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL dereference on root when tracing inode eviction When evicting an inode the first thing we do i |
| CVE-2025-71185 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation Make sure to drop the reference taken |
| CVE-2025-71186 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: stm32: dmamux: fix device leak on route allocation Make sure to drop the reference taken when looki |
| CVE-2025-71187 | Analyzed | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: fix device leak on probe failure Make sure to drop the reference taken when looking up |
| CVE-2025-71188 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when look |
| CVE-2025-71189 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw: dmamux: fix OF node leak on route allocation failure Make sure to drop the reference taken to t |
| CVE-2025-71190 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken when looking up the ma |
| CVE-2025-71191 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_hdmac: fix device leak on of_dma_xlate() Make sure to drop the reference taken when looking up t | |
| CVE-2025-7713 | Modified | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Content Management System |
| CVE-2025-7714 | Modified | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) |
| CVE-2025-7740 | Deferred | 未確認 | CWE-1392 | Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment |
| CVE-2025-7964 | Deferred | 未確認 | CWE-229 | After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a |
| CVE-2025-8072 | Deferred | 未確認 | CWE-79 | The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img’ parameter in all versions up to, and including, 3.8.8 due |
| CVE-2025-8090 | Deferred | 未確認 | CWE-476 | Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino kernel. |
| CVE-2025-8306 | Deferred | 未確認 | CWE-1220 | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwor |
| CVE-2025-8307 | Deferred | 未確認 | CWE-257 | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an e |
| CVE-2025-8615 | Deferred | 未確認 | CWE-79 | The CubeWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cubewp_shortcode_taxonomy shortcode in all versions up to, and including, 1.1.26 due t |
| CVE-2025-9014 | Analyzed | 未確認 | CWE-20, CWE-476 | A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthentica |
| CVE-2025-9082 | Deferred | 未確認 | CWE-79 | The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget parameters in versions up to, and including, 1.8 due to insuff |
| CVE-2025-9110 | Analyzed | 未確認 | CWE-497 | An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers |
| CVE-2025-9142 | Deferred | 未確認 | CWE-22 | A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory. |
| CVE-2025-9222 | Modified | 未確認 | CWE-79 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated |
| CVE-2025-9226 | Deferred | 未確認 | CWE-79 | Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details. |
| CVE-2025-9278 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the device loses ICMP connectivity, causing |
| CVE-2025-9279 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm tests, the device rebo |
| CVE-2025-9280 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become unresponsive, requirin |
| CVE-2025-9281 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm tests, the device re |
| CVE-2025-9282 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm tests, the device reboo |
| CVE-2025-9283 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limits Storms tests, the device re |
| CVE-2025-9289 | Analyzed | 未確認 | CWE-79 | A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as |
| CVE-2025-9290 | Analyzed | 未確認 | CWE-760 | An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requi |
| CVE-2025-9294 | Modified | 未確認 | CWE-285, CWE-862 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard |
| CVE-2025-9318 | Analyzed | 未確認 | CWE-89 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, a |
| CVE-2025-9427 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scripting (XSS).This issue |
| CVE-2025-9435 | Analyzed | 未確認 | CWE-22 | Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module |
| CVE-2025-9464 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. This vulnerability is triggered during fuzzing of multiple CIP classes, which causes |
| CVE-2025-9465 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive grammar tests, the device reboots une |
| CVE-2025-9466 | Analyzed | 未確認 | CWE-400 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP and CIP grammar tests, the device reboo |
| CVE-2025-9520 | Analyzed | 未確認 | CWE-639 | An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account. |
| CVE-2025-9521 | Analyzed | 未確認 | CWE-522 | Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password wi |
| CVE-2025-9522 | Analyzed | 未確認 | CWE-918 | Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to enumeration of inform |
| CVE-2025-9543 | Deferred | 未確認 | The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users such as admin to perfo | |
| CVE-2025-9611 | Deferred | 未確認 | CWE-749 | Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via |
| CVE-2025-9615 | Deferred | 未確認 | CWE-281 | A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's |
| CVE-2025-9637 | Analyzed | 未確認 | CWE-862 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and sta |
| CVE-2025-9820 | Deferred | 未確認 | CWE-121 | A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected i |
| CVE-2026-0203 | Modified | 未確認 | CWE-755 | An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS allows an unauthenticated, network-adjacent attacker sending a specif |
| CVE-2026-0227 | Analyzed | 未確認 | CWE-754 | A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issu |
| CVE-2026-0386 | Analyzed | 未確認 | CWE-284 | Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network. |
| CVE-2026-0403 | Analyzed | 未確認 | CWE-20 | An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections. |
| CVE-2026-0404 | Analyzed | 未確認 | CWE-20 | An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS com |
| CVE-2026-0405 | Analyzed | 未確認 | CWE-287 | An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin. |
| CVE-2026-0406 | Analyzed | 未確認 | CWE-20 | An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command injections. |
| CVE-2026-0407 | Analyzed | 未確認 | CWE-287 | An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to |
| CVE-2026-0408 | Analyzed | 未確認 | CWE-287 | A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically gen |
| CVE-2026-0421 | Deferred | 未確認 | CWE-252 | A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when con |
| CVE-2026-0483 | Deferred | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file contai |
| CVE-2026-0491 | Deferred | 未確認 | CWE-94 | SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrar |
| CVE-2026-0492 | Analyzed | 未確認 | CWE-306 | SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. |
| CVE-2026-0493 | Deferred | 未確認 | CWE-352 | Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute state?changing actions using an inappropriat |
| CVE-2026-0494 | Deferred | 未確認 | CWE-497 | Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low im |
| CVE-2026-0495 | Deferred | 未確認 | CWE-15 | SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaign |
| CVE-2026-0496 | Deferred | 未確認 | CWE-434 | SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) without proper file format validation. This h |
| CVE-2026-0497 | Deferred | 未確認 | CWE-862 | SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low impact on confidential |
| CVE-2026-0498 | Analyzed | 未確認 | CWE-94 | SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injecti |
| CVE-2026-0499 | Deferred | 未確認 | CWE-79 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed i |
| CVE-2026-0500 | Analyzed | 未確認 | CWE-94 | Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Networ |
| CVE-2026-0501 | Deferred | 未確認 | CWE-89 | Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modif |
| CVE-2026-0503 | Deferred | 未確認 | CWE-862 | Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and b |
| CVE-2026-0504 | Deferred | 未確認 | CWE-943 | Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are pr |
| CVE-2026-0506 | Analyzed | 未確認 | CWE-862 | Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FO |
| CVE-2026-0507 | Deferred | 未確認 | CWE-78 | Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network |
| CVE-2026-0510 | Deferred | 未確認 | CWE-326 | The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness |
| CVE-2026-0511 | Deferred | 未確認 | CWE-862 | SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high im |
| CVE-2026-0513 | Analyzed | 未確認 | CWE-601 | Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if access |
| CVE-2026-0514 | Analyzed | 未確認 | CWE-79 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, t |
| CVE-2026-0517 | Analyzed | 未確認 | CWE-400 | CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a server and cause the s |
| CVE-2026-0518 | Analyzed | 未確認 | CWE-79 | CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere with another administr |
| CVE-2026-0519 | Analyzed | 未確認 | CWE-532 | In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those |
| CVE-2026-0528 | Analyzed | 未確認 | CWE-129 | Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially craft |
| CVE-2026-0529 | Deferred | 未確認 | CWE-129 | Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network t |
| CVE-2026-0530 | Analyzed | 未確認 | CWE-770 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the applica |
| CVE-2026-0531 | Analyzed | 未確認 | CWE-770 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This req |
| CVE-2026-0532 | Deferred | 未確認 | CWE-918 | External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially craf |
| CVE-2026-0533 | Modified | 未確認 | CWE-79 | A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vul |
| CVE-2026-0534 | Modified | 未確認 | CWE-79 | A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop |
| CVE-2026-0535 | Modified | 未確認 | CWE-79 | A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion |
| CVE-2026-0543 | Analyzed | 未確認 | CWE-20, CWE-770 | Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address paramete |
| CVE-2026-0544 | Analyzed | 未確認 | CWE-74, CWE-89 | A security flaw has been discovered in itsourcecode School Management System 1.0. This affects an unknown part of the file /student/index.php. The manipulation of the argument ID r |
| CVE-2026-0546 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in code-projects Content Management System 1.0. This impacts an unknown function of the file search.php. This manipulation of the argument Value caus |
| CVE-2026-0547 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the componen |
| CVE-2026-0548 | Deferred | 未確認 | CWE-862 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existin |
| CVE-2026-0554 | Deferred | 未確認 | CWE-862 | The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in al |
| CVE-2026-0563 | Deferred | 未確認 | CWE-79 | The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_map' shortcode in all |
| CVE-2026-0565 | Modified | 未確認 | CWE-74, CWE-89 | A weakness has been identified in code-projects Content Management System 1.0. This issue affects some unknown processing of the file /admin/delete.php. Executing a manipulation of |
| CVE-2026-0566 | Analyzed | 未確認 | CWE-284, CWE-434 | A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/edit_posts.php. The manipulation of th |
| CVE-2026-0567 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in code-projects Content Management System 1.0. The affected element is an unknown function of the file /pages.php. The manipulation of the argument ID |
| CVE-2026-0568 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Frontend/ViewSongs.php. This manipulation of the argument ID |
| CVE-2026-0569 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in code-projects Online Music Site 1.0. This affects an unknown function of the file /Frontend/AlbumByCategory.php. Such manipulation of the argument |
| CVE-2026-0570 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was found in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Frontend/Feedback.php. Performing a manipulation of the argument fna |
| CVE-2026-0571 | Analyzed | 未確認 | CWE-22 | A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected by this issue is the function createResponseEntity of the file ware |
| CVE-2026-0574 | Analyzed | 未確認 | CWE-266, CWE-285 | A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function saveUserRole of the file warehouse\src\main\java\com\ye |
| CVE-2026-0575 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. This impacts an unknown function of the file /handgunner-administrator/adminlogin |
| CVE-2026-0576 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in code-projects Online Product Reservation System 1.0. Affected is an unknown function of the file /handgunner-administrator/prod.php of the component |
| CVE-2026-0577 | Modified | 未確認 | CWE-284, CWE-434 | A flaw has been found in code-projects Online Product Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /handgunner-administrator/prod. |
| CVE-2026-0578 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in code-projects Online Product Reservation System 1.0. Affected by this issue is some unknown functionality of the file /handgunner-administrator/de |
| CVE-2026-0579 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was found in code-projects Online Product Reservation System 1.0. This affects an unknown part of the file /handgunner-administrator/edit.php of the component POST |
| CVE-2026-0580 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability was found in SourceCodester API Key Manager App 1.0. Affected by this vulnerability is an unknown functionality of the component Import Key Handler. Performing a ma |
| CVE-2026-0581 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was determined in Tenda AC1206 15.03.06.23. Affected by this issue is the function formBehaviorManager of the file /goform/BehaviorManager of the component httpd. E |
| CVE-2026-0582 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_activity_query.php. The manipulation of the argum |
| CVE-2026-0583 | Analyzed | 未確認 | CWE-74, CWE-89 | A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This vulnerability affects unknown code of the file app/user/login.php of the component |
| CVE-2026-0584 | Analyzed | 未確認 | CWE-74, CWE-89 | A weakness has been identified in code-projects Online Product Reservation System 1.0. This issue affects some unknown processing of the file app/products/left_cart.php. This manip |
| CVE-2026-0585 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /order_view.php of the component GET |
| CVE-2026-0586 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability was detected in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file handgunner-administrator/prod.php. Perf |
| CVE-2026-0587 | Analyzed | 未確認 | CWE-79, CWE-94 | A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The m |
| CVE-2026-0588 | Analyzed | 未確認 | CWE-79, CWE-94 | A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This m |
| CVE-2026-0589 | Analyzed | 未確認 | CWE-287 | A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results |
| CVE-2026-0590 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file /app/checkout/delete.php of the compo |
| CVE-2026-0591 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in code-projects Online Product Reservation System 1.0. The impacted element is an unknown function of the file /app/checkout/update.php of the compo |
| CVE-2026-0592 | Analyzed | 未確認 | CWE-74, CWE-89 | A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This affects an unknown function of the file /handgunner-administrator/register_code.php |
| CVE-2026-0593 | Deferred | 未確認 | CWE-862 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processBackgroundAction() |
| CVE-2026-0594 | Deferred | 未確認 | CWE-79 | The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficien |
| CVE-2026-0597 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in Campcodes Supplier Management System 1.0. Affected by this issue is some unknown functionality of the file /retailer/edit_profile.php. This manipulation of |
| CVE-2026-0600 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with UR |
| CVE-2026-0601 | Deferred | 未確認 | CWE-79 | A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a sp |
| CVE-2026-0603 | Deferred | 未確認 | CWE-89 | A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphan |
| CVE-2026-0604 | Deferred | 未確認 | CWE-22 | The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7 via the 'dir_path' parameter i |
| CVE-2026-0605 | Modified | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. Such manipulat |
| CVE-2026-0606 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /FrontEnd/Albums.php. Performing a manipulatio |
| CVE-2026-0607 | Modified | 未確認 | CWE-74, CWE-89 | A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminViewSongs.php. Executing a manipulation of the argume |
| CVE-2026-0608 | Deferred | 未確認 | CWE-79 | The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and including, 20251118 due to |
| CVE-2026-0610 | Analyzed | 未確認 | CWE-89 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
| CVE-2026-0612 | Analyzed | 未確認 | The Librarian contains a information leakage vulnerability through the `web_fetch` tool, which can be used to retrieve arbitrary external content provided by an attacker, which can | |
| CVE-2026-0613 | Analyzed | 未確認 | CWE-918 | The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behavior to perform GET requests to internal |
| CVE-2026-0615 | Analyzed | 未確認 | The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within TheLibrarian backend. The vendor has fixed | |
| CVE-2026-0616 | Analyzed | 未確認 | TheLibrarians web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibrarian backend system. The vendor has fixe | |
| CVE-2026-0618 | Analyzed | 未確認 | CWE-79 | Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. |
| CVE-2026-0621 | Analyzed | 未確認 | CWE-1333 | Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC |
| CVE-2026-0622 | Analyzed | 未確認 | CWE-798 | Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset |
| CVE-2026-0625 | Deferred | 未確認 | CWE-306 | Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to |
| CVE-2026-0627 | Deferred | 未確認 | CWE-79 | The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.1.10. This is due to insufficient sani |
| CVE-2026-0628 | Analyzed | 未確認 | CWE-862 | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts |
| CVE-2026-0629 | Deferred | 未確認 | CWE-287 | Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password witho |
| CVE-2026-0633 | Deferred | 未確認 | CWE-287 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, |
| CVE-2026-0635 | Deferred | 未確認 | CWE-862 | The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' |
| CVE-2026-0640 | Analyzed | 未確認 | CWE-119, CWE-120 | A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead |
| CVE-2026-0641 | Analyzed | 未確認 | CWE-74, CWE-77 | A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the file cstecgi.cgi. The manipulation of t |
| CVE-2026-0642 | Modified | 未確認 | CWE-79, CWE-94 | A vulnerability was detected in projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /app/complaint.php. The manipulation of |
| CVE-2026-0643 | Analyzed | 未確認 | CWE-284, CWE-434 | A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This |
| CVE-2026-0648 | Analyzed | 未確認 | CWE-253, CWE-787 | The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the retur |
| CVE-2026-0649 | Deferred | 未確認 | CWE-918 | A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration |
| CVE-2026-0650 | Deferred | 未確認 | CWE-306, CWE-425 | OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitel |
| CVE-2026-0656 | Deferred | 未確認 | CWE-862 | The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' |
| CVE-2026-0663 | Modified | 未確認 | CWE-1286 | Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the M-Files Server proc |
| CVE-2026-0668 | Analyzed | 未確認 | CWE-1333 | Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.This issue affects Med |
| CVE-2026-0669 | Analyzed | 未確認 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affe |
| CVE-2026-0670 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-S |
| CVE-2026-0671 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Si |
| CVE-2026-0672 | Deferred | 未確認 | CWE-93 | When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie name |
| CVE-2026-0674 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects |
| CVE-2026-0675 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-0676 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: from n/a through <= 1.5 |
| CVE-2026-0678 | Deferred | 未確認 | CWE-89 | The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to, and including, 1.0.3 |
| CVE-2026-0680 | Deferred | 未確認 | CWE-79 | The Real Post Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insufficient in |
| CVE-2026-0682 | Deferred | 未確認 | CWE-918 | The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs |
| CVE-2026-0683 | Deferred | 未確認 | CWE-89 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and |
| CVE-2026-0684 | Deferred | 未確認 | CWE-863 | The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error in the 'cpis_admin_ini |
| CVE-2026-0687 | Deferred | 未確認 | CWE-862 | The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom post type in all versi |
| CVE-2026-0690 | Deferred | 未確認 | CWE-79 | The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field in all versions up t |
| CVE-2026-0691 | Deferred | 未確認 | CWE-79 | The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all ver |
| CVE-2026-0694 | Deferred | 未確認 | CWE-79 | The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the pl |
| CVE-2026-0695 | Modified | 未確認 | CWE-79 | In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under spec |
| CVE-2026-0696 | Modified | 未確認 | CWE-1004 | In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to s |
| CVE-2026-0697 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /intern/admin/edit_admin.php. This manipulat |
| CVE-2026-0698 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in code-projects Intern Membership Management System 1.0. This affects an unknown function of the file /intern/admin/edit_students.php. Such manipula |
| CVE-2026-0699 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of the file /intern/admin/edit_activity.php. Performing a manip |
| CVE-2026-0700 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a mani |
| CVE-2026-0701 | Modified | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /intern/admin/add_ad |
| CVE-2026-0702 | Deferred | 未確認 | CWE-89 | The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 |
| CVE-2026-0705 | Deferred | 未確認 | CWE-276 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.4.25342.354. |
| CVE-2026-0707 | Deferred | 未確認 | CWE-551 | A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard |
| CVE-2026-0709 | Deferred | 未確認 | CWE-78 | Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw |
| CVE-2026-0710 | Deferred | 未確認 | CWE-476 | A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages during an active call. This vulnerability, a |
| CVE-2026-0712 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-0713 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-0716 | Deferred | 未確認 | CWE-805 | A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, t |
| CVE-2026-0717 | Deferred | 未確認 | CWE-200 | The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lott |
| CVE-2026-0719 | Deferred | 未確認 | CWE-121 | A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely lon |
| CVE-2026-0723 | Analyzed | 未確認 | CWE-252 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with |
| CVE-2026-0725 | Deferred | 未確認 | CWE-79 | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient |
| CVE-2026-0726 | Deferred | 未確認 | CWE-502 | The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via deserialization of untru |
| CVE-2026-0728 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /intern/admin/delete_adm |
| CVE-2026-0729 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /intern/admin/add_activity.php. Performing a mani |
| CVE-2026-0730 | Analyzed | 未確認 | CWE-79, CWE-94 | A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADD_STAFF/UPDATE_STAFF of the file /staffleave/slms/slms/adminviews.py o |
| CVE-2026-0731 | Analyzed | 未確認 | CWE-404, CWE-476 | A vulnerability has been found in TOTOLINK WA1200 5.9c.2914. The impacted element is an unknown function of the file cstecgi.cgi of the component HTTP Request Handler. The manipula |
| CVE-2026-0732 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument path results in command |
| CVE-2026-0733 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/manage-students.php. This |
| CVE-2026-0734 | Deferred | 未確認 | CWE-79 | The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insuffic |
| CVE-2026-0739 | Deferred | 未確認 | CWE-79 | The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 due to insufficient in |
| CVE-2026-0741 | Deferred | 未確認 | CWE-79 | The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insu |
| CVE-2026-0746 | Deferred | 未確認 | CWE-918 | The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the 'get_audio' function. This makes it possible for |
| CVE-2026-0747 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external ob |
| CVE-2026-0749 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).This issue affects Drupa |
| CVE-2026-0750 | Analyzed | 未確認 | CWE-347 | Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal |
| CVE-2026-0755 | Deferred | 未確認 | CWE-78 | gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of g |
| CVE-2026-0756 | Deferred | 未確認 | CWE-78 | github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installat |
| CVE-2026-0757 | Deferred | 未確認 | CWE-78 | MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox on affected installa |
| CVE-2026-0758 | Deferred | 未確認 | CWE-78 | mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installati |
| CVE-2026-0759 | Deferred | 未確認 | CWE-78 | Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on |
| CVE-2026-0760 | Analyzed | 未確認 | CWE-502 | Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary |
| CVE-2026-0761 | Analyzed | 未確認 | CWE-94 | Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af |
| CVE-2026-0762 | Analyzed | 未確認 | CWE-502 | GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins |
| CVE-2026-0763 | Analyzed | 未確認 | CWE-502 | GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c |
| CVE-2026-0764 | Analyzed | 未確認 | CWE-502 | GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa |
| CVE-2026-0765 | Rejected | 未確認 | Rejected reason: Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant pe | |
| CVE-2026-0766 | Rejected | 未確認 | Rejected reason: Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant per | |
| CVE-2026-0767 | Rejected | 未確認 | Rejected reason: Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment d | |
| CVE-2026-0768 | Analyzed | 未確認 | CWE-94 | Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authen |
| CVE-2026-0769 | Analyzed | 未確認 | CWE-95 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installatio |
| CVE-2026-0770 | Analyzed | 掲載 | CWE-829 | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary |
| CVE-2026-0771 | Analyzed | 未確認 | CWE-94 | Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langfl |
| CVE-2026-0772 | Analyzed | 未確認 | CWE-502 | Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa |
| CVE-2026-0773 | Deferred | 未確認 | CWE-502 | Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa |
| CVE-2026-0774 | Deferred | 未確認 | CWE-88 | WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected i |
| CVE-2026-0775 | Deferred | 未確認 | CWE-732 | npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm |
| CVE-2026-0776 | Deferred | 未確認 | CWE-427 | Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations |
| CVE-2026-0778 | Deferred | 未確認 | CWE-306 | Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affe |
| CVE-2026-0779 | Analyzed | 未確認 | CWE-77, CWE-78 | ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation |
| CVE-2026-0780 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati |
| CVE-2026-0781 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati |
| CVE-2026-0782 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati |
| CVE-2026-0783 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati |
| CVE-2026-0784 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati |
| CVE-2026-0785 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations |
| CVE-2026-0786 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations |
| CVE-2026-0787 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations |
| CVE-2026-0788 | Analyzed | 未確認 | CWE-79 | ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability. This vulnerability allows remote attackers to execute web requests with a target user's privileges |
| CVE-2026-0789 | Analyzed | 未確認 | CWE-200 | ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s |
| CVE-2026-0790 | Analyzed | 未確認 | CWE-425 | ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected inst |
| CVE-2026-0791 | Analyzed | 未確認 | CWE-121, CWE-787 | ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code |
| CVE-2026-0792 | Analyzed | 未確認 | CWE-121, CWE-787 | ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co |
| CVE-2026-0793 | Analyzed | 未確認 | CWE-122, CWE-787 | ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec |
| CVE-2026-0794 | Analyzed | 未確認 | CWE-416 | ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of |
| CVE-2026-0795 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati |
| CVE-2026-0796 | Analyzed | 未確認 | CWE-78 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati |
| CVE-2026-0798 | Analyzed | 未確認 | CWE-284 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previousl |
| CVE-2026-0800 | Deferred | 未確認 | CWE-79 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom fields in all versions u |
| CVE-2026-0803 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. The manipulation of the argument studentr |
| CVE-2026-0805 | Analyzed | 未確認 | CWE-22 | An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code e |
| CVE-2026-0806 | Deferred | 未確認 | CWE-89 | The WP-ClanWars plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user |
| CVE-2026-0807 | Deferred | 未確認 | CWE-918 | The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'ur |
| CVE-2026-0808 | Deferred | 未確認 | CWE-602 | The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied |
| CVE-2026-0810 | Modified | 未確認 | CWE-135, CWE-682 | A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety i |
| CVE-2026-0812 | Deferred | 未確認 | CWE-79 | The LinkedIn SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkedin_sc_date_format', 'linkedin_sc_api_key', and 'linkedin_sc_secret_key' parameters |
| CVE-2026-0813 | Deferred | 未確認 | CWE-79 | The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all versions up to, and i |
| CVE-2026-0817 | Analyzed | 未確認 | CWE-862 | Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.4 |
| CVE-2026-0818 | Modified | 未確認 | CWE-116, CWE-200, CWE-352 | When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, t |
| CVE-2026-0820 | Deferred | 未確認 | CWE-862 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_u |
| CVE-2026-0821 | Modified | 未確認 | CWE-119, CWE-122 | A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file quickjs.c. Executing a manipulatio |
| CVE-2026-0822 | Modified | 未確認 | CWE-119, CWE-122, CWE-787 | A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based b |
| CVE-2026-0823 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been remov | |
| CVE-2026-0824 | Deferred | 未確認 | CWE-79, CWE-94 | A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The |
| CVE-2026-0825 | Deferred | 未確認 | CWE-862 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionalit |
| CVE-2026-0830 | Analyzed | 未確認 | CWE-78 | Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when openi |
| CVE-2026-0831 | Deferred | 未確認 | CWE-863 | The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_templ |
| CVE-2026-0832 | Deferred | 未確認 | CWE-862 | The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in |
| CVE-2026-0833 | Deferred | 未確認 | CWE-79 | The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due to insufficient inpu |
| CVE-2026-0834 | Modified | 未確認 | CWE-290 | Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands inc |
| CVE-2026-0836 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argum |
| CVE-2026-0837 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was identified in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formFireWall. Such manipulation of the argument GroupName leads to |
| CVE-2026-0838 | Analyzed | 未確認 | CWE-119, CWE-120 | A security flaw has been discovered in UTT 进取 520W 1.7.7-180627. This impacts the function strcpy of the file /goform/ConfigWirelessBase. Performing a manipulation of the argument |
| CVE-2026-0839 | Analyzed | 未確認 | CWE-119, CWE-120 | A weakness has been identified in UTT 进取 520W 1.7.7-180627. Affected is the function strcpy of the file /goform/APSecurity. Executing a manipulation of the argument wepkey1 can lea |
| CVE-2026-0840 | Analyzed | 未確認 | CWE-119, CWE-120 | A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this vulnerability is the function strcpy of the file /goform/formConfigNoticeConfig. The manipu |
| CVE-2026-0841 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formPictureUrl. The manipulation of the argument importp |
| CVE-2026-0842 | Deferred | 未確認 | CWE-287, CWE-306 | A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulation causes missing au |
| CVE-2026-0843 | Deferred | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103. This vulnerability affects unknown code of the file /index.php/api/product. |
| CVE-2026-0844 | Deferred | 未確認 | CWE-284 | The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_f |
| CVE-2026-0850 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /admin/delete_activity.php. Executing a manipul |
| CVE-2026-0851 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation |
| CVE-2026-0852 | Analyzed | 未確認 | CWE-74, CWE-89 | A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The mani |
| CVE-2026-0853 | Deferred | 未確認 | CWE-497 | Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access the debug page and obtain |
| CVE-2026-0854 | Deferred | 未確認 | CWE-78 | Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them o |
| CVE-2026-0855 | Deferred | 未確認 | CWE-78 | Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them |
| CVE-2026-0858 | Analyzed | 未確認 | CWE-79 | Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagra |
| CVE-2026-0859 | Analyzed | 未確認 | CWE-502 | TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send comm |
| CVE-2026-0861 | Analyzed | 未確認 | CWE-190 | Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overf |
| CVE-2026-0862 | Deferred | 未確認 | CWE-79 | The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all versions up to, and including, 4.5.5 due |
| CVE-2026-0863 | Analyzed | 未確認 | CWE-94, CWE-95 | Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying |
| CVE-2026-0865 | Deferred | 未確認 | CWE-74 | User-controlled header names and values containing newlines can allow injecting HTTP headers. |
| CVE-2026-0877 | Modified | 未確認 | CWE-693 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0878 | Modified | 未確認 | CWE-119, CWE-20 | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thu |
| CVE-2026-0879 | Modified | 未確認 | CWE-119 | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, |
| CVE-2026-0880 | Modified | 未確認 | CWE-190 | Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbi |
| CVE-2026-0881 | Modified | 未確認 | CWE-284, CWE-693 | Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
| CVE-2026-0882 | Modified | 未確認 | CWE-416 | Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0883 | Modified | 未確認 | CWE-200 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0884 | Modified | 未確認 | CWE-416 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0885 | Modified | 未確認 | CWE-416 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0886 | Modified | 未確認 | CWE-119 | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0887 | Modified | 未確認 | CWE-497 | Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0888 | Modified | 未確認 | CWE-200 | Information disclosure in the XML component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
| CVE-2026-0889 | Modified | 未確認 | CWE-400 | Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
| CVE-2026-0890 | Modified | 未確認 | CWE-290 | Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
| CVE-2026-0891 | Modified | 未確認 | CWE-119 | Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that |
| CVE-2026-0892 | Modified | 未確認 | CWE-119 | Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha |
| CVE-2026-0895 | Deferred | 未確認 | CWE-502 | The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-s |
| CVE-2026-0897 | Modified | 未確認 | CWE-770 | Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a |
| CVE-2026-0899 | Analyzed | 未確認 | CWE-125, CWE-787 | Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium secu |
| CVE-2026-0900 | Analyzed | 未確認 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium sec | |
| CVE-2026-0901 | Analyzed | 未確認 | CWE-451 | Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium securit |
| CVE-2026-0902 | Analyzed | 未確認 | CWE-474 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium secu |
| CVE-2026-0903 | Analyzed | 未確認 | CWE-20 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious fil |
| CVE-2026-0904 | Analyzed | 未確認 | CWE-451 | Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium securit |
| CVE-2026-0905 | Analyzed | 未確認 | CWE-200 | Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain potentially sensitive inf |
| CVE-2026-0906 | Analyzed | 未確認 | CWE-451 | Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromiu |
| CVE-2026-0907 | Analyzed | 未確認 | CWE-451 | Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: L |
| CVE-2026-0908 | Analyzed | 未確認 | CWE-416 | Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severit |
| CVE-2026-0911 | Deferred | 未確認 | CWE-434 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_impor |
| CVE-2026-0913 | Deferred | 未確認 | CWE-79 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'usp_access' shortcode |
| CVE-2026-0914 | Deferred | 未確認 | CWE-79 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lw_content_block' shortcode in all versions up to, and including, 3.1. |
| CVE-2026-0915 | Analyzed | 未確認 | CWE-908 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Libr |
| CVE-2026-0916 | Deferred | 未確認 | CWE-79 | The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'related_posts_by_tax' shortcode in all versions up to, and includi |
| CVE-2026-0918 | Modified | 未確認 | CWE-476 | The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memor |
| CVE-2026-0919 | Modified | 未確認 | CWE-20 | The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup |
| CVE-2026-0920 | Deferred | 未確認 | CWE-269 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_r |
| CVE-2026-0925 | Analyzed | 未確認 | CWE-1284 | Tanium addressed an improper input validation vulnerability in Discover. |
| CVE-2026-0927 | Deferred | 未確認 | CWE-862 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport( |
| CVE-2026-0933 | Analyzed | 未確認 | CWE-20 | SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed d |
| CVE-2026-0936 | Deferred | 未確認 | CWE-532 | An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential info |
| CVE-2026-0939 | Deferred | 未確認 | CWE-345 | The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and inclu |
| CVE-2026-0942 | Deferred | 未確認 | CWE-306 | The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the |
| CVE-2026-0943 | Analyzed | 未確認 | CWE-476 | HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfBuzz 8.4.0 or earlier |
| CVE-2026-0949 | Analyzed | 未確認 | CWE-79 | PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript |
| CVE-2026-0959 | Analyzed | 未確認 | CWE-787 | IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service |
| CVE-2026-0960 | Analyzed | 未確認 | CWE-835 | HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service |
| CVE-2026-0961 | Analyzed | 未確認 | CWE-787 | BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service |
| CVE-2026-0962 | Analyzed | 未確認 | CWE-787 | SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service |
| CVE-2026-0963 | Analyzed | 未確認 | CWE-22 | An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remot |
| CVE-2026-0975 | Analyzed | 未確認 | CWE-77 | Delta Electronics DIAView has Command Injection vulnerability. |
| CVE-2026-0976 | Deferred | 未確認 | CWE-20 | A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common revers |
| CVE-2026-0988 | Deferred | 未確認 | CWE-190 | A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation |
| CVE-2026-0989 | Analyzed | 未確認 | CWE-674 | A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving |
| CVE-2026-0990 | Analyzed | 未確認 | CWE-674 | A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegat |
| CVE-2026-0991 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-0992 | Analyzed | 未確認 | CWE-400 | A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements point |
| CVE-2026-0994 | Modified | 未確認 | CWE-674 | A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google. |
| CVE-2026-1000 | Deferred | 未確認 | CWE-862 | The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due |
| CVE-2026-1002 | Analyzed | 未確認 | CWE-444 | The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI. The issue comes |
| CVE-2026-1003 | Deferred | 未確認 | CWE-862 | The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is |
| CVE-2026-1004 | Deferred | 未確認 | CWE-862 | The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_po |
| CVE-2026-1007 | Analyzed | 未確認 | CWE-863 | Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2 |
| CVE-2026-1008 | Analyzed | 未確認 | CWE-79 | A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to in |
| CVE-2026-1009 | Analyzed | 未確認 | CWE-284, CWE-79 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inje |
| CVE-2026-1010 | Analyzed | 未確認 | CWE-269, CWE-79 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular aut |
| CVE-2026-1011 | Analyzed | 未確認 | CWE-116, CWE-79 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interfa |
| CVE-2026-1012 | Rejected | 未確認 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been remov | |
| CVE-2026-1018 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-1019 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-1020 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-1021 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-1022 | Analyzed | 未確認 | CWE-23 | Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arb |
| CVE-2026-1023 | Analyzed | 未確認 | CWE-306 | Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a specific functionality to |
| CVE-2026-1035 | Deferred | 未確認 | CWE-367 | A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict |
| CVE-2026-1036 | Deferred | 未確認 | CWE-862 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_c |
| CVE-2026-1042 | Deferred | 未確認 | CWE-79 | The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and including, 1.02 due to |
| CVE-2026-1045 | Deferred | 未確認 | CWE-79 | The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.2 due to insufficient input sanitiza |
| CVE-2026-1048 | Analyzed | 未確認 | CWE-79, CWE-94 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulation of the argument Tic |
| CVE-2026-1049 | Analyzed | 未確認 | CWE-79, CWE-94 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument Ti |
| CVE-2026-1050 | Deferred | 未確認 | CWE-74, CWE-89 | A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.jav |
| CVE-2026-1051 | Deferred | 未確認 | CWE-352 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0. This is due to mis |
| CVE-2026-1053 | Deferred | 未確認 | CWE-79 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.13 due to |
| CVE-2026-1054 | Deferred | 未確認 | CWE-862 | The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capabilit |
| CVE-2026-1056 | Deferred | 未確認 | CWE-22 | The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions |
| CVE-2026-1059 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa. Affected by this vulnerability is an unknown functionality of the file /sr |
| CVE-2026-1060 | Deferred | 未確認 | CWE-200 | The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST |
| CVE-2026-1061 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. |
| CVE-2026-1062 | Analyzed | 未確認 | CWE-918 | A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argum |
| CVE-2026-1063 | Deferred | 未確認 | CWE-74, CWE-77 | A vulnerability has been found in bastillion-io Bastillion up to 4.0.1. This vulnerability affects unknown code of the file src/main/java/io/bastillion/manage/control/AuthKeysKtrl. |
| CVE-2026-1064 | Deferred | 未確認 | CWE-74, CWE-77 | A vulnerability was found in bastillion-io Bastillion up to 4.0.1. This issue affects some unknown processing of the file src/main/java/io/bastillion/manage/control/SystemKtrl.java |
| CVE-2026-1066 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was detected in kalcaddle kodbox up to 1.61.10. This issue affects some unknown processing of the file /?explorer/index/zip of the component Compression Handler. Th |
| CVE-2026-1070 | Deferred | 未確認 | CWE-352 | The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce validation on the ale |
| CVE-2026-1075 | Deferred | 未確認 | CWE-352 | The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to improper nonce validation on the save_zt |
| CVE-2026-1076 | Deferred | 未確認 | CWE-352 | The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing nonce validation on the |
| CVE-2026-1081 | Deferred | 未確認 | CWE-352 | The Set Bulk Post Categories plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on |
| CVE-2026-1083 | Deferred | 未確認 | CWE-79 | The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuration parameters in all versions up to, and |
| CVE-2026-1084 | Deferred | 未確認 | CWE-79 | The Cookie consent for developers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple settings fields in all versions up to, and including, 1.7.1 due to |
| CVE-2026-1088 | Deferred | 未確認 | CWE-352 | The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the dev |
| CVE-2026-1095 | Deferred | 未確認 | CWE-79 | The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions up to, and including, 1.0 due to insuffici |
| CVE-2026-1097 | Deferred | 未確認 | CWE-79 | The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' shortcode attributes i |
| CVE-2026-1098 | Deferred | 未確認 | CWE-79 | The CM CSS Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to, and including, 1.2.1 due to insufficie |
| CVE-2026-1099 | Deferred | 未確認 | CWE-79 | The Administrative Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'login' and 'logout' shortcode attributes in all versions up to, and includi |
| CVE-2026-1102 | Analyzed | 未確認 | CWE-770 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated |
| CVE-2026-1103 | Deferred | 未確認 | CWE-862 | The AIKTP plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the /aiktp/getToken REST API endpoint in all versions up to |
| CVE-2026-1105 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argument _order leads to sq |
| CVE-2026-1106 | Analyzed | 未確認 | CWE-266, CWE-285 | A security flaw has been discovered in Chamilo LMS up to 2.0.0 Beta 1. This issue affects the function deleteLegal of the file src/CoreBundle/Controller/SocialController.php of the |
| CVE-2026-1107 | Analyzed | 未確認 | CWE-284, CWE-434 | A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handler. Executing a manip |
| CVE-2026-1108 | Analyzed | 未確認 | CWE-119, CWE-120 | A security vulnerability has been detected in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. The affected element is the function rtsp_rely_dumps. The manipulation |
| CVE-2026-1109 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was detected in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. The impacted element is the function rtsp_parse_request. The manipulation results in |
| CVE-2026-1110 | Analyzed | 未確認 | CWE-119, CWE-120 | A flaw has been found in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. This affects the function rtsp_parse_method. This manipulation causes buffer overflow. It is |
| CVE-2026-1111 | Analyzed | 未確認 | CWE-22 | A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java |
| CVE-2026-1112 | Analyzed | 未確認 | CWE-266, CWE-285 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeA |
| CVE-2026-1118 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.php. Performing a manipulation of the ar |
| CVE-2026-1119 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Executing a manipulation of |
| CVE-2026-1120 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Parameter Handler. The |
| CVE-2026-1121 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Handler. The manipulation |
| CVE-2026-1122 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulat |
| CVE-2026-1123 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Handler. Such manipulatio |
| CVE-2026-1124 | Analyzed | 未確認 | CWE-74, CWE-89 | A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of the component HTTP GET |
| CVE-2026-1125 | Modified | 未確認 | CWE-74, CWE-77 | A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of th |
| CVE-2026-1126 | Deferred | 未確認 | CWE-284, CWE-434 | A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \flow-master\flow-front-rest |
| CVE-2026-1127 | Deferred | 未確認 | CWE-79 | The Timeline Event History plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `id` parameter in all versions up to, and including, 3.2 due to insufficient |
| CVE-2026-1129 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Parameter Handler. The manipu |
| CVE-2026-1130 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Parameter Handler. This mani |
| CVE-2026-1131 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handler. Such manipulation |
| CVE-2026-1132 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter Handler. Performing a |
| CVE-2026-1133 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter Handler. Executing a |
| CVE-2026-1134 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown function of the file /admin/expenses.php. The manipulation of the argument det |
| CVE-2026-1135 | Analyzed | 未確認 | CWE-79, CWE-94 | A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activity.php. The manipulation of the argumen |
| CVE-2026-1136 | Deferred | 未確認 | CWE-79, CWE-94 | A weakness has been identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. Affected is the function Save of the file /blog/bContent/save of the component Cont |
| CVE-2026-1137 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formWebAuthGlobalConfig. Performing a manipulation resul |
| CVE-2026-1138 | Analyzed | 未確認 | CWE-119, CWE-120 | A flaw has been found in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/ConfigExceptQQ. Executing a manipulation can lead to buffer overflow. The at |
| CVE-2026-1139 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/ConfigExceptMSN. The manipulation leads to buffer ove |
| CVE-2026-1140 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigExceptAli. The manipulation results in buffer overflow. It i |
| CVE-2026-1141 | Modified | 未確認 | CWE-266, CWE-285 | A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component Add Sub-Admin Page. |
| CVE-2026-1142 | Analyzed | 未確認 | CWE-352, CWE-862 | A security flaw has been discovered in PHPGurukul News Portal 1.0. The impacted element is an unknown function. Performing a manipulation results in cross-site request forgery. The |
| CVE-2026-1143 | Analyzed | 未確認 | CWE-119, CWE-120 | A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of |
| CVE-2026-1144 | Modified | 未確認 | CWE-119, CWE-416 | A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation result |
| CVE-2026-1145 | Modified | 未確認 | CWE-119, CWE-122 | A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. This manipulation caus |
| CVE-2026-1146 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality of the file / |
| CVE-2026-1147 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_patient_schedule.php. |
| CVE-2026-1148 | Analyzed | 未確認 | CWE-352, CWE-862 | A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Executing a manipulation |
| CVE-2026-1149 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Reque |
| CVE-2026-1150 | Analyzed | 未確認 | CWE-74, CWE-77 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Reques |
| CVE-2026-1151 | Analyzed | 未確認 | CWE-79, CWE-94 | A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation of the argument Nick |
| CVE-2026-1152 | Analyzed | 未確認 | CWE-284, CWE-434 | A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Handler. Such manipulatio |
| CVE-2026-1153 | Analyzed | 未確認 | CWE-352, CWE-862 | A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploita |
| CVE-2026-1154 | Analyzed | 未確認 | CWE-74, CWE-80 | A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modules/lesson/index.php of the component Lesson Module Handler. |
| CVE-2026-1155 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipula |
| CVE-2026-1156 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. This manipulation o |
| CVE-2026-1157 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument |
| CVE-2026-1158 | Analyzed | 未確認 | CWE-119, CWE-120 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component |
| CVE-2026-1159 | Analyzed | 未確認 | CWE-74, CWE-89 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.php. Executing a manipu |
| CVE-2026-1160 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the component Search. The manipu |
| CVE-2026-1161 | Deferred | 未確認 | CWE-79, CWE-94 | A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipulation results in cross |
| CVE-2026-1162 | Analyzed | 未確認 | CWE-119, CWE-120 | A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipulation of the argument passwd1 causes buf |
| CVE-2026-1165 | Deferred | 未確認 | CWE-352 | The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'pub |
| CVE-2026-1169 | Modified | 未確認 | CWE-352, CWE-862 | A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. The a |
| CVE-2026-1170 | Modified | 未確認 | CWE-200, CWE-284 | A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API. Performing a manipula |
| CVE-2026-1171 | Modified | 未確認 | CWE-404 | A flaw has been found in birkir prime up to 0.4.0.beta.0. Impacted is an unknown function of the file /graphql of the component GraphQL Field Handler. Executing a manipulation can |
| CVE-2026-1172 | Modified | 未確認 | CWE-404 | A vulnerability has been found in birkir prime up to 0.4.0.beta.0. The affected element is an unknown function of the file /graphql of the component GraphQL Directive Handler. The |
| CVE-2026-1173 | Modified | 未確認 | CWE-404 | A vulnerability was found in birkir prime up to 0.4.0.beta.0. The impacted element is an unknown function of the file /graphql of the component GraphQL Array Based Query Batch Hand |
| CVE-2026-1174 | Modified | 未確認 | CWE-400, CWE-404 | A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component GraphQL Alias Handler. This manipulation c |
| CVE-2026-1175 | Analyzed | 未確認 | CWE-200, CWE-209 | A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Handler. Such manipulati |
| CVE-2026-1176 | Analyzed | 未確認 | CWE-74, CWE-89 | A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a manipulation of the a |
| CVE-2026-1177 | Analyzed | 未確認 | CWE-74, CWE-89 | A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component HTTP GET Parameter H |
| CVE-2026-1178 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter |
| CVE-2026-1179 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. The manipulation of the |
| CVE-2026-1180 | Deferred | 未確認 | CWE-918 | A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a client to specify an arbi |
| CVE-2026-1181 | Deferred | 未確認 | CWE-284, CWE-942 | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Alti |
| CVE-2026-1183 | Deferred | 未確認 | CWE-79 | HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an HTML injection due to a lack of proper validation of user in |
| CVE-2026-1188 | Analyzed | 未確認 | CWE-120, CWE-131 | In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator |
| CVE-2026-1189 | Deferred | 未確認 | CWE-79 | The LeadBI Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter of the 'leadbi_form' shortcode in all versions up to, |
| CVE-2026-1190 | Deferred | 未確認 | CWE-112 | A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the |
| CVE-2026-1191 | Deferred | 未確認 | CWE-79 | The JavaScript Notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 1.2.8. This is due to insufficie |
| CVE-2026-1192 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unknown function of the file /cgi-bin/imode_alldata.php. Executi |
| CVE-2026-1193 | Analyzed | 未確認 | CWE-266, CWE-285 | A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface. The manipulation le |
| CVE-2026-1194 | Analyzed | 未確認 | CWE-200, CWE-284 | A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information disclosure. The attack |
| CVE-2026-1195 | Analyzed | 未確認 | CWE-345 | A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insu |
| CVE-2026-1196 | Analyzed | 未確認 | CWE-200, CWE-284 | A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the argument ID leads to |
| CVE-2026-1197 | Analyzed | 未確認 | CWE-200, CWE-284 | A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a manipulation of the arg |
| CVE-2026-1201 | Deferred | 未確認 | CWE-639 | An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated use |
| CVE-2026-1202 | Analyzed | 未確認 | CWE-287 | A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a |
| CVE-2026-1203 | Analyzed | 未確認 | CWE-287 | A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php of the component JSON |
| CVE-2026-1208 | Deferred | 未確認 | CWE-352 | The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect |
| CVE-2026-1213 | Analyzed | 未確認 | CWE-639 | All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue |
| CVE-2026-1218 | Deferred | 未確認 | CWE-610, CWE-611 | A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.artery.richclient.RichCli |
| CVE-2026-1221 | Deferred | 未確認 | CWE-798 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to the databas |
| CVE-2026-1222 | Deferred | 未確認 | CWE-434 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backd |
| CVE-2026-1223 | Deferred | 未確認 | CWE-522 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to allowing authentica |
| CVE-2026-1224 | Analyzed | 未確認 | CWE-770 | Tanium addressed an uncontrolled resource consumption vulnerability in Discover. |
| CVE-2026-1225 | Deferred | 未確認 | CWE-20 | ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes alread |
| CVE-2026-1237 | Deferred | 未確認 | CWE-347, CWE-672 | Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invali |
| CVE-2026-1244 | Deferred | 未確認 | CWE-79 | The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in the 'financoop_campaign' shortcode in |
| CVE-2026-1245 | Analyzed | 未確認 | CWE-94 | A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names o |
| CVE-2026-1251 | Deferred | 未確認 | CWE-639 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via |
| CVE-2026-1257 | Deferred | 未確認 | CWE-98 | The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' |
| CVE-2026-1260 | Modified | 未確認 | CWE-119 | Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure. |
| CVE-2026-1266 | Deferred | 未確認 | CWE-79 | The Postalicious plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due to insufficient input sanitiza |
| CVE-2026-1280 | Deferred | 未確認 | CWE-862 | The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all vers |
| CVE-2026-1281 | Analyzed | 掲載 | CWE-94 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. |
| CVE-2026-1283 | Deferred | 未確認 | CWE-122 | A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop |
| CVE-2026-1284 | Deferred | 未確認 | CWE-787 | An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 |
| CVE-2026-1290 | Deferred | 未確認 | CWE-305 | Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24. |
| CVE-2026-1295 | Deferred | 未確認 | CWE-79 | The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions up to, and including, |
| CVE-2026-1298 | Deferred | 未確認 | CWE-862 | The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `ima |
| CVE-2026-1299 | Deferred | 未確認 | CWE-93 | The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when a |
| CVE-2026-1300 | Deferred | 未確認 | CWE-79 | The Responsive Header plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple plugin settings parameters in all versions up to, and including, 1.0 due to ins |
| CVE-2026-1302 | Deferred | 未確認 | CWE-79 | The Meta-box GalleryMeta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due to insufficient input |
| CVE-2026-1310 | Deferred | 未確認 | CWE-862 | The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks |
| CVE-2026-1315 | Analyzed | 未確認 | CWE-20 | By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integ |
| CVE-2026-1324 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionController of the file /isomp-prot |
| CVE-2026-1325 | Analyzed | 未確認 | CWE-640 | A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/ed |
| CVE-2026-1326 | Analyzed | 未確認 | CWE-74, CWE-77 | A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST R |
| CVE-2026-1327 | Analyzed | 未確認 | CWE-74, CWE-77 | A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the compo |
| CVE-2026-1328 | Analyzed | 未確認 | CWE-119, CWE-120 | A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler |
| CVE-2026-1329 | Analyzed | 未確認 | CWE-119, CWE-121 | A flaw has been found in Tenda AX1803 1.0.0.1. The affected element is the function fromGetWifiGuestBasic of the file /goform/WifiGuestSet. Executing a manipulation of the argument |
| CVE-2026-1330 | Analyzed | 未確認 | CWE-36 | MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbit |
| CVE-2026-1331 | Analyzed | 未確認 | CWE-434 | MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby |
| CVE-2026-1332 | Analyzed | 未確認 | CWE-306 | MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meetin |
| CVE-2026-1340 | Analyzed | 掲載 | CWE-94 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. |
| CVE-2026-1361 | Analyzed | 未確認 | CWE-121, CWE-787 | ASDA-Soft Stack-based Buffer Overflow Vulnerability |
| CVE-2026-1363 | Deferred | 未確認 | CWE-603 | IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by mani |
| CVE-2026-1364 | Deferred | 未確認 | CWE-306 | IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities. |
| CVE-2026-1377 | Deferred | 未確認 | CWE-352 | The imwptip plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the settings upda |
| CVE-2026-1380 | Deferred | 未確認 | CWE-352 | The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce vali |
| CVE-2026-1381 | Deferred | 未確認 | CWE-79 | The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.6.8 d |
| CVE-2026-1386 | Analyzed | 未確認 | CWE-61 | A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pr |
| CVE-2026-1389 | Deferred | 未確認 | CWE-639 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. |
| CVE-2026-1391 | Deferred | 未確認 | CWE-79 | The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient input sanitization and |
| CVE-2026-1398 | Deferred | 未確認 | CWE-352 | The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation o |
| CVE-2026-1399 | Deferred | 未確認 | CWE-79 | The WP Google Ad Manager Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.0 due to insufficient |
| CVE-2026-1400 | Deferred | 未確認 | CWE-434 | The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_upd |
| CVE-2026-1406 | Deferred | 未確認 | CWE-601 | A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessCo |
| CVE-2026-1407 | Analyzed | 未確認 | CWE-200, CWE-284 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.09_55. This affects an unknown part of the component UART Interface. Performing a manipulation results in |
| CVE-2026-1408 | Analyzed | 未確認 | CWE-521 | A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09_55. This vulnerability affects unknown code of the component UART Interface. Executing a manipulation can le |
| CVE-2026-1409 | Analyzed | 未確認 | CWE-307, CWE-799 | A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. This issue affects some unknown processing of the component UART Interface. The manipulation |
| CVE-2026-1410 | Analyzed | 未確認 | CWE-287, CWE-306 | A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation results in missing authe |
| CVE-2026-1411 | Analyzed | 未確認 | CWE-266, CWE-284 | A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulation causes improper ac |
| CVE-2026-1412 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get |
| CVE-2026-1413 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_va |
| CVE-2026-1414 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Inf |
| CVE-2026-1415 | Modified | 未確認 | CWE-404, CWE-476 | A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the arg |
| CVE-2026-1416 | Modified | 未確認 | CWE-404, CWE-476 | A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation r |
| CVE-2026-1417 | Modified | 未確認 | CWE-404, CWE-476 | A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null p |
| CVE-2026-1418 | Modified | 未確認 | CWE-119, CWE-787 | A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT |
| CVE-2026-1419 | Analyzed | 未確認 | CWE-74, CWE-77 | A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation o |
| CVE-2026-1420 | Analyzed | 未確認 | CWE-119, CWE-120 | A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapsk_crypto causes buffer ov |
| CVE-2026-1421 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation leads to cross site scr |
| CVE-2026-1422 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login P |
| CVE-2026-1423 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /admin_pic.php. Executing a manipula |
| CVE-2026-1424 | Analyzed | 未確認 | CWE-284, CWE-434 | A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unrestricted upload. It i |
| CVE-2026-1425 | Deferred | 未確認 | CWE-119, CWE-121 | A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the c |
| CVE-2026-1427 | Analyzed | 未確認 | CWE-78 | Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute t |
| CVE-2026-1428 | Analyzed | 未確認 | CWE-78 | Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute t |
| CVE-2026-1429 | Analyzed | 未確認 | CWE-79 | Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript cod |
| CVE-2026-1431 | Deferred | 未確認 | CWE-862 | The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all ve |
| CVE-2026-1443 | Analyzed | 未確認 | CWE-74, CWE-89 | A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipula |
| CVE-2026-1444 | Deferred | 未確認 | CWE-79, CWE-94 | A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers/books_center/add_boo |
| CVE-2026-1445 | Deferred | 未確認 | CWE-284, CWE-434 | A vulnerability was found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This vulnerability affects unknown code of the file controllers/books_center/u |
| CVE-2026-1446 | Analyzed | 未確認 | CWE-79 | There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacti |
| CVE-2026-1448 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Perform |
| CVE-2026-1449 | Deferred | 未確認 | CWE-74, CWE-89 | A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Load of the file YZSoft/Forms/XForm/BM/BusComManagement/TireMng |
| CVE-2026-1453 | Deferred | 未確認 | CWE-306 | A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vul |
| CVE-2026-1457 | Analyzed | 未確認 | CWE-121 | An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attack |
| CVE-2026-1464 | Deferred | 未確認 | CWE-190 | Integer Overflow or Wraparound vulnerability in MuntashirAkon AppManager (app/src/main/java/org/apache/commons/compress/archivers/tar modules). This vulnerability is associated wit |
| CVE-2026-1465 | Deferred | 未確認 | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource (third_party/faad2-2.7/libfaad modules). This vul |
| CVE-2026-1466 | Analyzed | 未確認 | CWE-79 | Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done |
| CVE-2026-1467 | Analyzed | 未確認 | CWE-93 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the librar |
| CVE-2026-1469 | Analyzed | 未確認 | CWE-79 | Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload |
| CVE-2026-1470 | Analyzed | 未確認 | CWE-95 | n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configur |
| CVE-2026-1472 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1473 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1474 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1475 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1476 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1477 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1478 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1479 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1480 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1481 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1482 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1483 | Analyzed | 未確認 | CWE-89 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting th |
| CVE-2026-1484 | Deferred | 未確認 | CWE-787 | A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalc |
| CVE-2026-1485 | Deferred | 未確認 | CWE-124 | A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead |
| CVE-2026-1489 | Deferred | 未確認 | CWE-787 | A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extreme |
| CVE-2026-1498 | Deferred | 未確認 | CWE-90 | An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server |
| CVE-2026-1504 | Analyzed | 未確認 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium | |
| CVE-2026-1505 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The manipulation results i |
| CVE-2026-1506 | Analyzed | 未確認 | CWE-77, CWE-78 | A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php of the component MAC Filter Configuration. This manipulation |
| CVE-2026-1513 | Analyzed | 未確認 | CWE-79 | billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding. |
| CVE-2026-1514 | Deferred | 未確認 | CWE-863 | Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to modify front-end code to re |
| CVE-2026-1520 | Deferred | 未確認 | CWE-79, CWE-94 | A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such manipulation leads to c |
| CVE-2026-1521 | Modified | 未確認 | CWE-404 | A security flaw has been discovered in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_bearer_resource_failure_indication of the file src/sgwc/s5c-handler.c of the c |
| CVE-2026-1522 | Modified | 未確認 | CWE-404 | A weakness has been identified in Open5GS up to 2.7.6. This vulnerability affects the function sgwc_s5c_handle_modify_bearer_response of the file src/sgwc/s5c-handler.c of the comp |
| CVE-2026-1532 | Analyzed | 未確認 | CWE-22 | A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. |
| CVE-2026-1533 | Analyzed | 未確認 | CWE-74, CWE-89 | A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The man |
| CVE-2026-1534 | Analyzed | 未確認 | CWE-74, CWE-89 | A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This manipulation of the a |
| CVE-2026-1535 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation |
| CVE-2026-1536 | Analyzed | 未確認 | CWE-93 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. T |
| CVE-2026-1539 | Analyzed | 未確認 | CWE-201 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes th |
| CVE-2026-1544 | Analyzed | 未確認 | CWE-77, CWE-78 | A security flaw has been discovered in D-Link DIR-823X 250416. Impacted is the function sub_41E2A0 of the file /goform/set_mode. Performing a manipulation of the argument lan_gatew |
| CVE-2026-1545 | Analyzed | 未確認 | CWE-74, CWE-89 | A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executing a manipulation of |
| CVE-2026-1546 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExce |
| CVE-2026-1547 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_na |
| CVE-2026-1548 | Analyzed | 未確認 | CWE-74, CWE-77 | A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url c |
| CVE-2026-1549 | Analyzed | 未確認 | CWE-22 | A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of |
| CVE-2026-1550 | Analyzed | 未確認 | CWE-266, CWE-285 | A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospital/docappsystem/adminv |
| CVE-2026-1551 | Analyzed | 未確認 | CWE-74, CWE-89 | A weakness has been identified in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/course/controller.php. Executing a manipulation of t |
| CVE-2026-1552 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argument searchml leads to s |
| CVE-2026-1586 | Modified | 未確認 | CWE-404 | A flaw has been found in Open5GS up to 2.7.5. Impacted is the function ogs_gtp2_f_teid_to_ip of the file /sgwc/s11-handler.c of the component SGWC. Executing a manipulation can lea |
| CVE-2026-1587 | Modified | 未確認 | CWE-404 | A vulnerability has been found in Open5GS up to 2.7.6. The affected element is the function sgwc_s11_handle_modify_bearer_request of the file /sgwc/s11-handler.c of the component S |
| CVE-2026-1588 | Analyzed | 未確認 | CWE-22 | A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.star |
| CVE-2026-1589 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/inquiry/index.php. This manipulation of the argu |
| CVE-2026-1590 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was identified in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/faculty/index.php. Such manipulation of the argu |
| CVE-2026-1593 | Analyzed | 未確認 | CWE-74, CWE-89 | A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit_expenses_query.php. |
| CVE-2026-1594 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/add_expenses.php. |
| CVE-2026-1595 | Analyzed | 未確認 | CWE-74, CWE-89 | A vulnerability was detected in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_student_query.php. The manipulation of the argument |
| CVE-2026-1596 | Analyzed | 未確認 | CWE-74, CWE-77 | A flaw has been found in D-Link DWR-M961 1.1.47. This vulnerability affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument |
| CVE-2026-1597 | Analyzed | 未確認 | CWE-266, CWE-285 | A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such manipulation of the argu |
| CVE-2026-1598 | Analyzed | 未確認 | CWE-79, CWE-94 | A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. Impacted is an unknown function of the file /dashboard/home/profile of the compon |
| CVE-2026-1599 | Analyzed | 未確認 | CWE-840 | A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected element is an unknown function of the file /hungry/placeorder o |
| CVE-2026-1600 | Analyzed | 未確認 | CWE-840 | A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of |
| CVE-2026-1601 | Analyzed | 未確認 | CWE-74, CWE-77 | A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of t |
| CVE-2026-1610 | Analyzed | 未確認 | CWE-259, CWE-798 | A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24_cn. Affected by this issue is some unknown functionality of the component Telnet Service. Performing a manipulation resul |
| CVE-2026-1616 | Analyzed | 未確認 | CWE-22 | The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters. |
| CVE-2026-1623 | Analyzed | 未確認 | CWE-74, CWE-77 | A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName cau |
| CVE-2026-1624 | Analyzed | 未確認 | CWE-74, CWE-77 | A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation o |
| CVE-2026-1625 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boafrm/formSmsManage of the component SMS Message. Performing a |
| CVE-2026-1637 | Analyzed | 未確認 | CWE-119, CWE-121 | A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation leads to st |
| CVE-2026-1638 | Analyzed | 未確認 | CWE-74, CWE-77 | A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZSetCfg of the file /goform/mDMZSetCfg. The manipulation of t |
| CVE-2026-1665 | Deferred | 未確認 | CWE-78, CWE-95 | A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_H |
| CVE-2026-1680 | Analyzed | 未確認 | CWE-250 | Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Windows allows a local user to escalate their privileges to loc |
| CVE-2026-1682 | Modified | 未確認 | CWE-404, CWE-476 | A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the file internal/pfcp/handler/handler.go of the component PFCP UD |
| CVE-2026-1683 | Modified | 未確認 | CWE-404 | A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSessionReportRequest of the file internal/pfcp/handler/handler.g |
| CVE-2026-1684 | Modified | 未確認 | CWE-404 | A vulnerability was found in Free5GC SMF up to 4.1.0. Affected by this issue is the function HandleReports of the file /internal/context/pfcp_reports.go of the component PFCP UDP E |
| CVE-2026-1685 | Analyzed | 未確認 | CWE-307, CWE-799 | A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the component Login. Such manipulation leads to improper restriction |
| CVE-2026-1686 | Analyzed | 未確認 | CWE-119, CWE-120 | A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manip |
| CVE-2026-1687 | Analyzed | 未確認 | CWE-74, CWE-77 | A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the file /boaform/formSamba of the component Boa Webserver. Exe |
| CVE-2026-1688 | Analyzed | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an unknown function of the file /admin/index.php. The manipulati |
| CVE-2026-1689 | Analyzed | 未確認 | CWE-74, CWE-77 | A vulnerability was detected in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. The impacted element is the function checkUserFromLanOrWan of the file /boaform/admin/formLogin of t |
| CVE-2026-1690 | Analyzed | 未確認 | CWE-74, CWE-77 | A flaw has been found in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. This affects the function system of the file /boaform/formSysCmd. This manipulation of the argument sysCmd |
| CVE-2026-1691 | Analyzed | 未確認 | CWE-20, CWE-502 | A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the |
| CVE-2026-1699 | Analyzed | 未確認 | CWE-829 | In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull |
| CVE-2026-1700 | Analyzed | 未確認 | CWE-79, CWE-94 | A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknown code of the file /app/sms.php. This manipulation of the ar |
| CVE-2026-1701 | Modified | 未確認 | CWE-74, CWE-89 | A security vulnerability has been detected in itsourcecode School Management System 1.0. This issue affects some unknown processing of the file /enrollment/index.php. Such manipula |
| CVE-2026-1702 | Analyzed | 未確認 | CWE-266, CWE-285 | A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of the component User Man |
| CVE-2026-1705 | Deferred | 未確認 | CWE-79, CWE-94 | A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interface. Performing a manip |
| CVE-2026-1723 | Deferred | 未確認 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: t |
| CVE-2026-20026 | Deferred | 未確認 | CWE-415 | Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detecti |
| CVE-2026-20027 | Deferred | 未確認 | CWE-200 | Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection En |
| CVE-2026-20029 | Deferred | 未確認 | CWE-611 | A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attac |
| CVE-2026-20045 | Analyzed | 掲載 | CWE-94 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications |
| CVE-2026-20047 | Analyzed | 未確認 | CWE-80 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remot |
| CVE-2026-20055 | Deferred | 未確認 | CWE-79 | Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) |
| CVE-2026-20075 | Analyzed | 未確認 | CWE-79 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attac |
| CVE-2026-20076 | Analyzed | 未確認 | CWE-79 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored cross-site scripting |
| CVE-2026-20080 | Deferred | 未確認 | CWE-400 | A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH service to stop respond |
| CVE-2026-20092 | Deferred | 未確認 | CWE-732 | A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, local attacker with administrative privileges to elevate priv |
| CVE-2026-20109 | Deferred | 未確認 | CWE-79 | Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) |
| CVE-2026-20613 | Analyzed | 未確認 | CWE-22 | The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a |
| CVE-2026-20736 | Modified | 未確認 | CWE-284 | Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing acce |
| CVE-2026-20750 | Modified | 未確認 | CWE-284 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging |
| CVE-2026-20759 | Deferred | 未確認 | CWE-78 | OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the low("monitoring user") |
| CVE-2026-20800 | Analyzed | 未確認 | CWE-200 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may |
| CVE-2026-20803 | Analyzed | 未確認 | CWE-306 | Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-20804 | Analyzed | 未確認 | CWE-266 | Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally. |
| CVE-2026-20805 | Analyzed | 掲載 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. |
| CVE-2026-20808 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locall |
| CVE-2026-20809 | Analyzed | 未確認 | CWE-122, CWE-367 | Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20810 | Analyzed | 未確認 | CWE-590 | Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20811 | Analyzed | 未確認 | CWE-822, CWE-843 | Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20812 | Analyzed | 未確認 | CWE-20 | Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network. |
| CVE-2026-20814 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20815 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevat |
| CVE-2026-20816 | Analyzed | 未確認 | CWE-367 | Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20817 | Modified | 未確認 | CWE-280 | Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20818 | Analyzed | 未確認 | CWE-532 | Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-20819 | Analyzed | 未確認 | CWE-822 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally. |
| CVE-2026-20820 | Analyzed | 未確認 | CWE-122 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20821 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally. |
| CVE-2026-20822 | Analyzed | 未確認 | CWE-416 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20823 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
| CVE-2026-20824 | Analyzed | 未確認 | CWE-693 | Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2026-20825 | Analyzed | 未確認 | CWE-284 | Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally. |
| CVE-2026-20826 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to ele |
| CVE-2026-20827 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to disclose information locally. |
| CVE-2026-20828 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2026-20829 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. |
| CVE-2026-20830 | Analyzed | 未確認 | CWE-362, CWE-416 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevat |
| CVE-2026-20831 | Analyzed | 未確認 | CWE-367 | Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20832 | Analyzed | 未確認 | CWE-415 | Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability |
| CVE-2026-20833 | Analyzed | 未確認 | CWE-327 | Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally. |
| CVE-2026-20834 | Analyzed | 未確認 | CWE-359, CWE-36 | Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. |
| CVE-2026-20835 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in Capability Access Management Service (camsvc) allows an authorized attacker to disclose information locally. |
| CVE-2026-20836 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20837 | Analyzed | 未確認 | CWE-122 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally. |
| CVE-2026-20838 | Analyzed | 未確認 | CWE-209 | Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. |
| CVE-2026-20839 | Analyzed | 未確認 | CWE-284 | Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally. |
| CVE-2026-20840 | Analyzed | 未確認 | CWE-122 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
| CVE-2026-20842 | Analyzed | 未確認 | CWE-416 | Use after free in Windows DWM allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20843 | Analyzed | 未確認 | CWE-284 | Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20844 | Analyzed | 未確認 | CWE-362, CWE-416 | Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-20847 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-20848 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network |
| CVE-2026-20849 | Analyzed | 未確認 | CWE-807 | Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-20851 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally. |
| CVE-2026-20852 | Analyzed | 未確認 | CWE-266 | Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally. |
| CVE-2026-20853 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-20854 | Analyzed | 未確認 | CWE-416 | Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network. |
| CVE-2026-20856 | Analyzed | 未確認 | CWE-20 | Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network. |
| CVE-2026-20857 | Analyzed | 未確認 | CWE-822 | Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20858 | Analyzed | 未確認 | CWE-362, CWE-416 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20859 | Analyzed | 未確認 | CWE-416 | Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20860 | Analyzed | 未確認 | CWE-843 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20861 | Analyzed | 未確認 | CWE-362, CWE-415, CWE-416 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges local |
| CVE-2026-20862 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose information locally. |
| CVE-2026-20863 | Analyzed | 未確認 | CWE-415 | Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20864 | Modified | 未確認 | CWE-122 | Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20865 | Analyzed | 未確認 | CWE-416 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20866 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges local |
| CVE-2026-20867 | Analyzed | 未確認 | CWE-362, CWE-415, CWE-416 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges local |
| CVE-2026-20868 | Modified | 未確認 | CWE-122 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-20869 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileg |
| CVE-2026-20870 | Analyzed | 未確認 | CWE-416 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20871 | Analyzed | 未確認 | CWE-416 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20872 | Modified | 未確認 | CWE-73 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-20873 | Analyzed | 未確認 | CWE-362, CWE-416 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges local |
| CVE-2026-20874 | Analyzed | 未確認 | CWE-362, CWE-416 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges local |
| CVE-2026-20875 | Analyzed | 未確認 | CWE-476 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-20876 | Analyzed | 未確認 | CWE-122 | Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20877 | Analyzed | 未確認 | CWE-362, CWE-416 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20883 | Analyzed | 未確認 | CWE-284 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository |
| CVE-2026-20888 | Analyzed | 未確認 | CWE-284, CWE-862 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges |
| CVE-2026-20893 | Deferred | 未確認 | CWE-346 | Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability is exploited, an attacker who can log in |
| CVE-2026-20894 | Deferred | 未確認 | CWE-79 | Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures the affected product wi |
| CVE-2026-20897 | Modified | 未確認 | CWE-284, CWE-639 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other rep |
| CVE-2026-20904 | Analyzed | 未確認 | CWE-284, CWE-639 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identitie |
| CVE-2026-20912 | Modified | 未確認 | CWE-283, CWE-284, CWE-639 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release |
| CVE-2026-20918 | Analyzed | 未確認 | CWE-362, CWE-416 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges local |
| CVE-2026-20919 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network |
| CVE-2026-20920 | Analyzed | 未確認 | CWE-416 | Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20921 | Modified | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network |
| CVE-2026-20922 | Analyzed | 未確認 | CWE-122 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
| CVE-2026-20923 | Analyzed | 未確認 | CWE-416 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20924 | Analyzed | 未確認 | CWE-362, CWE-416 | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20925 | Analyzed | 未確認 | CWE-73 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-20926 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network |
| CVE-2026-20927 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network. |
| CVE-2026-20929 | Analyzed | 未確認 | CWE-284 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-20931 | Modified | 未確認 | CWE-73 | External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. |
| CVE-2026-20932 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
| CVE-2026-20934 | Analyzed | 未確認 | CWE-362 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network |
| CVE-2026-20935 | Analyzed | 未確認 | CWE-822 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally. |
| CVE-2026-20936 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack. |
| CVE-2026-20937 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
| CVE-2026-20938 | Analyzed | 未確認 | CWE-822 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20939 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
| CVE-2026-20940 | Analyzed | 未確認 | CWE-822 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20941 | Analyzed | 未確認 | CWE-59 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20943 | Analyzed | 未確認 | CWE-426 | Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. |
| CVE-2026-20944 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| CVE-2026-20946 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-20947 | Analyzed | 未確認 | CWE-89 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| CVE-2026-20948 | Analyzed | 未確認 | CWE-822 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| CVE-2026-20949 | Analyzed | 未確認 | CWE-284 | Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2026-20950 | Analyzed | 未確認 | CWE-416 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-20951 | Analyzed | 未確認 | CWE-20 | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
| CVE-2026-20952 | Analyzed | 未確認 | CWE-416 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
| CVE-2026-20953 | Analyzed | 未確認 | CWE-416 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
| CVE-2026-20955 | Analyzed | 未確認 | CWE-822 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-20956 | Analyzed | 未確認 | CWE-822 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-20957 | Analyzed | 未確認 | CWE-122, CWE-191 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-20958 | Analyzed | 未確認 | CWE-918 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
| CVE-2026-20959 | Analyzed | 未確認 | CWE-79 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network |
| CVE-2026-20960 | Analyzed | 未確認 | CWE-285, CWE-863 | Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network. |
| CVE-2026-20962 | Analyzed | 未確認 | CWE-908 | Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally. |
| CVE-2026-20963 | Analyzed | 掲載 | CWE-502 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
| CVE-2026-20965 | Analyzed | 未確認 | CWE-347 | Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20968 | Analyzed | 未確認 | CWE-416 | Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code. |
| CVE-2026-20969 | Analyzed | 未確認 | Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is required for triggering thi | |
| CVE-2026-20970 | Analyzed | 未確認 | Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs. | |
| CVE-2026-20971 | Analyzed | 未確認 | CWE-416 | Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code. |
| CVE-2026-20972 | Analyzed | 未確認 | Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. | |
| CVE-2026-20973 | Analyzed | 未確認 | CWE-125 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory. |
| CVE-2026-20974 | Analyzed | 未確認 | Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock. | |
| CVE-2026-20975 | Analyzed | 未確認 | Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbitrary path. | |
| CVE-2026-20976 | Analyzed | 未確認 | Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script. | |
| CVE-2026-21219 | Analyzed | 未確認 | CWE-416 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
| CVE-2026-21221 | Analyzed | 未確認 | CWE-362, CWE-416 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevat |
| CVE-2026-21223 | Modified | 未確認 | CWE-269 | Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally. |
| CVE-2026-21224 | Analyzed | 未確認 | CWE-121 | Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. |
| CVE-2026-21226 | Analyzed | 未確認 | CWE-502 | Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. |
| CVE-2026-21227 | Analyzed | 未確認 | CWE-22 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-21264 | Analyzed | 未確認 | CWE-79 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-21265 | Analyzed | 未確認 | CWE-1329 | Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versio |
| CVE-2026-21267 | Analyzed | 未確認 | CWE-78 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could |
| CVE-2026-21268 | Analyzed | 未確認 | CWE-20 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current |
| CVE-2026-21271 | Analyzed | 未確認 | CWE-20 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current |
| CVE-2026-21272 | Analyzed | 未確認 | CWE-20 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage |
| CVE-2026-21274 | Analyzed | 未確認 | CWE-863 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current u |
| CVE-2026-21275 | Analyzed | 未確認 | CWE-824 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of |
| CVE-2026-21276 | Analyzed | 未確認 | CWE-824 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of |
| CVE-2026-21277 | Analyzed | 未確認 | CWE-122, CWE-787 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the cu |
| CVE-2026-21278 | Analyzed | 未確認 | CWE-125 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerabi |
| CVE-2026-21280 | Analyzed | 未確認 | CWE-426 | Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current use |
| CVE-2026-21281 | Analyzed | 未確認 | CWE-122, CWE-787 | InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user |
| CVE-2026-21283 | Analyzed | 未確認 | CWE-122, CWE-787 | Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user |
| CVE-2026-21287 | Analyzed | 未確認 | CWE-416 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exp |
| CVE-2026-21288 | Analyzed | 未確認 | CWE-476 | Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit t |
| CVE-2026-21298 | Analyzed | 未確認 | CWE-787 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current u |
| CVE-2026-21299 | Analyzed | 未確認 | CWE-787 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current u |
| CVE-2026-21300 | Analyzed | 未確認 | CWE-476 | Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation of this is |
| CVE-2026-21301 | Analyzed | 未確認 | CWE-476 | Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation of this is |
| CVE-2026-21302 | Analyzed | 未確認 | CWE-125 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerabil |
| CVE-2026-21303 | Analyzed | 未確認 | CWE-125 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerabil |
| CVE-2026-21304 | Analyzed | 未確認 | CWE-122, CWE-787 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the cu |
| CVE-2026-21305 | Analyzed | 未確認 | CWE-787 | Substance3D - Painter versions 11.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current u |
| CVE-2026-21306 | Analyzed | 未確認 | CWE-787 | Substance3D - Sampler versions 5.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current us |
| CVE-2026-21307 | Analyzed | 未確認 | CWE-787 | Substance3D - Designer versions 15.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current |
| CVE-2026-21308 | Analyzed | 未確認 | CWE-125 | Substance3D - Designer versions 15.0.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerabi |
| CVE-2026-21408 | Deferred | 未確認 | CWE-427 | beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code |
| CVE-2026-21409 | Deferred | 未確認 | CWE-639 | Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and i |
| CVE-2026-21411 | Deferred | 未確認 | CWE-288 | Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password. |
| CVE-2026-21417 | Analyzed | 未確認 | CWE-256 | Dell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged attacker with remote access could potentia |
| CVE-2026-21418 | Analyzed | 未確認 | CWE-78 | Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged att |
| CVE-2026-21427 | Deferred | 未確認 | CWE-427 | The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a re |
| CVE-2026-21428 | Analyzed | 未確認 | CWE-93 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in u |
| CVE-2026-21429 | Analyzed | 未確認 | CWE-862 | Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete their articles after publishing them. As o |
| CVE-2026-21430 | Analyzed | 未確認 | CWE-352, CWE-79 | Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being |
| CVE-2026-21431 | Analyzed | 未確認 | CWE-79 | Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while publishing an articl |
| CVE-2026-21432 | Analyzed | 未確認 | CWE-79 | Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takeover, including takeover of admin accou |
| CVE-2026-21433 | Analyzed | 未確認 | CWE-918 | Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An atta |
| CVE-2026-21436 | Analyzed | 未確認 | CWE-24 | eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installati |
| CVE-2026-21437 | Analyzed | 未確認 | CWE-353 | eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the inst |
| CVE-2026-21439 | Analyzed | 未確認 | CWE-150 | badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control char |
| CVE-2026-21440 | Deferred | 未確認 | CWE-22 | AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary l |
| CVE-2026-21441 | Modified | 未確認 | CWE-409 | urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than l |
| CVE-2026-21444 | Analyzed | 未確認 | CWE-327, CWE-330 | libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3. |
| CVE-2026-21445 | Analyzed | 未確認 | CWE-306 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication |
| CVE-2026-21446 | Analyzed | 未確認 | CWE-306 | Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The under |
| CVE-2026-21447 | Analyzed | 未確認 | CWE-284, CWE-639 | Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any a |
| CVE-2026-21448 | Analyzed | 未確認 | CWE-1336 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the ` |
| CVE-2026-21449 | Analyzed | 未確認 | CWE-1336 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege us |
| CVE-2026-21450 | Analyzed | 未確認 | CWE-1336 | Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code ex |
| CVE-2026-21451 | Analyzed | 未確認 | CWE-79 | Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Althou |
| CVE-2026-21452 | Analyzed | 未確認 | CWE-400, CWE-789 | MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT3 |
| CVE-2026-21483 | Analyzed | 未確認 | CWE-79 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious |
| CVE-2026-21484 | Analyzed | 未確認 | CWE-203, CWE-204 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 |
| CVE-2026-21485 | Analyzed | 未確認 | CWE-125, CWE-1284, CWE-190, CWE-20, CWE-400, CWE-476, CWE-787 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory |
| CVE-2026-21486 | Analyzed | 未確認 | CWE-122, CWE-190, CWE-416, CWE-787 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below contain Use After Free, Heap-based Buffer Overflow and Integ |
| CVE-2026-21487 | Analyzed | 未確認 | CWE-125, CWE-20, CWE-823 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offs |
| CVE-2026-21488 | Analyzed | 未確認 | CWE-122, CWE-125, CWE-170 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Over |
| CVE-2026-21489 | Analyzed | 未確認 | CWE-125, CWE-191 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have Out-of-bounds Read and Integer Underflow (Wrap or Wrapa |
| CVE-2026-21490 | Analyzed | 未確認 | CWE-122, CWE-125, CWE-193 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vuln |
| CVE-2026-21491 | Analyzed | 未確認 | CWE-122, CWE-125, CWE-193 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vuln |
| CVE-2026-21492 | Analyzed | 未確認 | CWE-252, CWE-476 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21493 | Analyzed | 未確認 | CWE-188, CWE-703, CWE-843 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCu |
| CVE-2026-21494 | Analyzed | 未確認 | CWE-122, CWE-125, CWE-193 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vuln |
| CVE-2026-21495 | Analyzed | 未確認 | CWE-20, CWE-369 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21496 | Analyzed | 未確認 | CWE-20, CWE-252, CWE-476, CWE-690 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21497 | Analyzed | 未確認 | CWE-20, CWE-252, CWE-476 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21498 | Analyzed | 未確認 | CWE-20, CWE-252, CWE-476, CWE-690 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21499 | Analyzed | 未確認 | CWE-20, CWE-476, CWE-690 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21500 | Analyzed | 未確認 | CWE-1119, CWE-20, CWE-400, CWE-674, CWE-787 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21501 | Analyzed | 未確認 | CWE-20, CWE-787 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21502 | Analyzed | 未確認 | CWE-20, CWE-252, CWE-476, CWE-690 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21503 | Analyzed | 未確認 | CWE-131, CWE-20, CWE-476, CWE-628 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has un |
| CVE-2026-21504 | Analyzed | 未確認 | CWE-122, CWE-193, CWE-787 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21505 | Analyzed | 未確認 | CWE-20, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has un |
| CVE-2026-21506 | Analyzed | 未確認 | CWE-20, CWE-476 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21507 | Analyzed | 未確認 | CWE-835 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have an infinite loop in the IccProfile.cpp function, CalcProf |
| CVE-2026-21509 | Analyzed | 掲載 | CWE-807 | Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2026-21520 | Analyzed | 未確認 | CWE-77 | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector |
| CVE-2026-21521 | Analyzed | 未確認 | CWE-150 | Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-21524 | Analyzed | 未確認 | CWE-200 | Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-21569 | Analyzed | 未確認 | CWE-611 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) v |
| CVE-2026-21618 | Modified | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) a |
| CVE-2026-21623 | Analyzed | 未確認 | CWE-79 | Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla. |
| CVE-2026-21624 | Analyzed | 未確認 | CWE-79 | Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla. |
| CVE-2026-21625 | Analyzed | 未確認 | CWE-434 | User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening. |
| CVE-2026-21633 | Analyzed | 未確認 | CWE-287 | A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Prote |
| CVE-2026-21634 | Analyzed | 未確認 | CWE-119 | A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery protocol causing it to restart. Affec |
| CVE-2026-21635 | Analyzed | 未確認 | CWE-284 | An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted v |
| CVE-2026-21636 | Analyzed | 未確認 | CWE-284 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker |
| CVE-2026-21637 | Analyzed | 未確認 | CWE-400 | A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions t |
| CVE-2026-21638 | Analyzed | 未確認 | CWE-77 | A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected |
| CVE-2026-21639 | Modified | 未確認 | CWE-120, CWE-77 | A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected |
| CVE-2026-21640 | Analyzed | 未確認 | CWE-134 | HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a sett |
| CVE-2026-21641 | Analyzed | 未確認 | CWE-285 | HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to |
| CVE-2026-21642 | Analyzed | 未確認 | CWE-79 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can c |
| CVE-2026-21644 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21645 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21646 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21647 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21648 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21649 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21650 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21651 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21652 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21663 | Analyzed | 未確認 | CWE-79 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that |
| CVE-2026-21664 | Analyzed | 未確認 | CWE-79 | HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a sp |
| CVE-2026-21673 | Analyzed | 未確認 | CWE-190, CWE-681, CWE-704 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in CIccXmlArrayType::ParseTextC |
| CVE-2026-21674 | Analyzed | 未確認 | CWE-401 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Pat |
| CVE-2026-21675 | Analyzed | 未確認 | CWE-20, CWE-416 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Creat |
| CVE-2026-21676 | Analyzed | 未確認 | CWE-122 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate fun |
| CVE-2026-21677 | Analyzed | 未確認 | CWE-20, CWE-758 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which i |
| CVE-2026-21678 | Analyzed | 未確認 | CWE-122, CWE-125, CWE-20, CWE-787 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21679 | Analyzed | 未確認 | CWE-20, CWE-787 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vul |
| CVE-2026-21680 | Analyzed | 未確認 | CWE-476 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21681 | Analyzed | 未確認 | CWE-20 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21682 | Analyzed | 未確認 | CWE-122, CWE-20 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21683 | Analyzed | 未確認 | CWE-20, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21684 | Analyzed | 未確認 | CWE-20, CWE-758 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21685 | Analyzed | 未確認 | CWE-20, CWE-758 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21686 | Analyzed | 未確認 | CWE-20, CWE-758 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21687 | Analyzed | 未確認 | CWE-20, CWE-758 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21688 | Analyzed | 未確認 | CWE-190, CWE-20, CWE-476, CWE-681 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21689 | Analyzed | 未確認 | CWE-190, CWE-20, CWE-232, CWE-476, CWE-690, CWE-754, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21690 | Analyzed | 未確認 | CWE-20, CWE-457, CWE-475, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21691 | Analyzed | 未確認 | CWE-1025, CWE-140, CWE-20, CWE-476, CWE-697, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21692 | Analyzed | 未確認 | CWE-20, CWE-588, CWE-704, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21693 | Analyzed | 未確認 | CWE-20, CWE-681, CWE-754, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-21694 | Analyzed | 未確認 | CWE-284 | Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private p |
| CVE-2026-21695 | Analyzed | 未確認 | CWE-915 | Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary |
| CVE-2026-21696 | Analyzed | 未確認 | CWE-400, CWE-770 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider |
| CVE-2026-21697 | Analyzed | 未確認 | CWE-362 | axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated d |
| CVE-2026-21720 | Modified | 未確認 | CWE-400, CWE-703, CWE-772 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler ti |
| CVE-2026-21721 | Modified | 未確認 | CWE-639, CWE-863 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management righ |
| CVE-2026-21744 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21745 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21746 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21747 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21748 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21749 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21750 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-21851 | Analyzed | 未確認 | CWE-22 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability exists in MONAI's `_d |
| CVE-2026-21852 | Analyzed | 未確認 | CWE-522 | Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthrop |
| CVE-2026-21854 | Analyzed | 未確認 | CWE-1321, CWE-287, CWE-843 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated |
| CVE-2026-21855 | Analyzed | 未確認 | CWE-79 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast notification system al |
| CVE-2026-21856 | Analyzed | 未確認 | CWE-89 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time based blind SQL injection vulnerability in the we |
| CVE-2026-21857 | Analyzed | 未確認 | CWE-22, CWE-24 | REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal |
| CVE-2026-21858 | Analyzed | 未確認 | CWE-20 | n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of |
| CVE-2026-21859 | Analyzed | 未確認 | CWE-918 | Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attacker |
| CVE-2026-21860 | Analyzed | 未確認 | CWE-67 | Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extens |
| CVE-2026-21865 | Analyzed | 未確認 | CWE-862 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can convert some personal messages to public topics when |
| CVE-2026-21867 | Rejected | 未確認 | Rejected reason: Reason: This candidate was issued in error. | |
| CVE-2026-21868 | Analyzed | 未確認 | CWE-1333 | Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/u |
| CVE-2026-21869 | Analyzed | 未確認 | CWE-787 | llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is parsed directly from JSON input in the llama.cpp server's compl |
| CVE-2026-21871 | Analyzed | 未確認 | CWE-79 | NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push |
| CVE-2026-21872 | Analyzed | 未確認 | CWE-79 | NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with attacker-controlled |
| CVE-2026-21873 | Analyzed | 未確認 | CWE-79 | NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulat |
| CVE-2026-21874 | Analyzed | 未確認 | CWE-772 | NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on |
| CVE-2026-21875 | Analyzed | 未確認 | CWE-89 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a chan |
| CVE-2026-21876 | Modified | 未確認 | CWE-794 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922 |
| CVE-2026-21877 | Analyzed | 未確認 | CWE-434, CWE-94 | n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could |
| CVE-2026-21879 | Analyzed | 未確認 | CWE-601 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect |
| CVE-2026-21880 | Analyzed | 未確認 | CWE-200, CWE-90 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-sup |
| CVE-2026-21881 | Analyzed | 未確認 | CWE-287 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enable |
| CVE-2026-21883 | Analyzed | 未確認 | CWE-1385 | Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can re |
| CVE-2026-21884 | Modified | 未確認 | CWE-79 | React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollResto |
| CVE-2026-21885 | Analyzed | 未確認 | CWE-918 | Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side |
| CVE-2026-21889 | Analyzed | 未確認 | CWE-284 | Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthen |
| CVE-2026-21891 | Analyzed | 未確認 | CWE-287 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the use |
| CVE-2026-21892 | Analyzed | 未確認 | CWE-89 | Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL |
| CVE-2026-21894 | Analyzed | 未確認 | CWE-290 | n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticat |
| CVE-2026-21895 | Analyzed | 未確認 | CWE-703 | The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning |
| CVE-2026-21896 | Analyzed | 未確認 | CWE-863 | Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby |
| CVE-2026-21897 | Analyzed | 未確認 | CWE-787 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-21898 | Analyzed | 未確認 | CWE-125 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-21899 | Analyzed | 未確認 | CWE-125 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-21900 | Analyzed | 未確認 | CWE-125 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-21903 | Analyzed | 未確認 | CWE-121 | A Stack-based Buffer Overflow vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a network-based attacker, authenticated with low privileges to |
| CVE-2026-21905 | Analyzed | 未確認 | CWE-835 | A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the SIP application layer gateway (ALG) of Juniper Networks Junos OS on SRX Series and MX Series with MX-S |
| CVE-2026-21906 | Analyzed | 未確認 | CWE-755 | An Improper Handling of Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-base |
| CVE-2026-21907 | Analyzed | 未確認 | CWE-327 | A Use of a Broken or Risky Cryptographic Algorithm vulnerability in the TLS/SSL server of Juniper Networks Junos Space allows the use of static key ciphers (ssl-static-key-ciphers) |
| CVE-2026-21908 | Analyzed | 未確認 | CWE-416 | A Use After Free vulnerability was identified in the 802.1X authentication daemon (dot1xd) of Juniper Networks Junos OS and Junos OS Evolved that could allow an authenticated, netw |
| CVE-2026-21909 | Analyzed | 未確認 | CWE-401 | A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated att |
| CVE-2026-21910 | Analyzed | 未確認 | CWE-754 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX4k Series and QFX5k Series platforms a |
| CVE-2026-21911 | Analyzed | 未確認 | CWE-682 | An Incorrect Calculation vulnerability in the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker f |
| CVE-2026-21912 | Analyzed | 未確認 | CWE-367 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the method to collect FPC Ethernet firmware statistics of Juniper Networks Junos OS on MX10k Series allows a lo |
| CVE-2026-21913 | Analyzed | 未確認 | CWE-665 | An Incorrect Initialization of Resource vulnerability in the Internal Device Manager (IDM) of Juniper Networks Junos OS on EX4000 models allows an unauthenticated, network-based at |
| CVE-2026-21914 | Analyzed | 未確認 | CWE-667 | An Improper Locking vulnerability in the GTP plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (Dos). |
| CVE-2026-21917 | Analyzed | 未確認 | CWE-1286 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-bas |
| CVE-2026-21918 | Analyzed | 未確認 | CWE-415 | A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Den |
| CVE-2026-21920 | Analyzed | 未確認 | CWE-252 | An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service |
| CVE-2026-21921 | Analyzed | 未確認 | CWE-416 | A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker authenticated with low privileges |
| CVE-2026-21922 | Analyzed | 未確認 | Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). The supported version that is affected is 25.04.07. Easily exp | |
| CVE-2026-21923 | Analyzed | 未確認 | Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0 | |
| CVE-2026-21924 | Analyzed | 未確認 | Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General). Supported versions that are affected are 4.4.0.3.0, 4.5. | |
| CVE-2026-21925 | Modified | 未確認 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are | |
| CVE-2026-21926 | Analyzed | 未確認 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-25.2. Easily exploitable | |
| CVE-2026-21927 | Analyzed | 未確認 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). The supported version that is affected is 11. Easily exploitable vulnerability allows high priv | |
| CVE-2026-21928 | Modified | 未確認 | CWE-200 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthent |
| CVE-2026-21929 | Analyzed | 未確認 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Difficult to exploit vulnerability all | |
| CVE-2026-21930 | Analyzed | 未確認 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easily exploitable vulner | |
| CVE-2026-21931 | Analyzed | 未確認 | Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Supported versions that are affected are 23.2.0, 23.2.1, 24.1.0, 24 | |
| CVE-2026-21932 | Modified | 未確認 | CWE-1287 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affe |
| CVE-2026-21933 | Modified | 未確認 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affec | |
| CVE-2026-21934 | Analyzed | 未確認 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.60, 8.61 and 8.62. | |
| CVE-2026-21935 | Analyzed | 未確認 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). The supported version that is affected is 11. Easily exploitable vulnerability allows high priv | |
| CVE-2026-21936 | Analyzed | 未確認 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploita | |
| CVE-2026-21937 | Analyzed | 未確認 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exp | |
| CVE-2026-21938 | Analyzed | 未確認 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily expl | |
| CVE-2026-21939 | Analyzed | 未確認 | Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.0. Difficult to exploit vulnerability allows unauthenticated | |
| CVE-2026-21940 | Analyzed | 未確認 | CWE-200 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easily exploitable vulnera |
| CVE-2026-21941 | Analyzed | 未確認 | CWE-400 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easi |
| CVE-2026-21942 | Analyzed | 未確認 | CWE-400 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allow |
| CVE-2026-21943 | Analyzed | 未確認 | CWE-79 | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable |
| CVE-2026-21944 | Analyzed | 未確認 | CWE-79 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is a |
| CVE-2026-21945 | Modified | 未確認 | CWE-295, CWE-400 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affecte |
| CVE-2026-21946 | Analyzed | 未確認 | CWE-79 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.0. Easily ex |
| CVE-2026-21947 | Modified | 未確認 | CWE-79 | Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated |
| CVE-2026-21948 | Analyzed | 未確認 | CWE-400 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easi |
| CVE-2026-21949 | Analyzed | 未確認 | CWE-400 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability al |
| CVE-2026-21950 | Analyzed | 未確認 | CWE-400 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability al |
| CVE-2026-21951 | Analyzed | 未確認 | CWE-79 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.60, 8.61 and 8.62. |
| CVE-2026-21952 | Analyzed | 未確認 | CWE-400 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allow |
| CVE-2026-21955 | Analyzed | 未確認 | CWE-400 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner |
| CVE-2026-21956 | Analyzed | 未確認 | CWE-400 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner |
| CVE-2026-21957 | Analyzed | 未確認 | CWE-269 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vuln |
| CVE-2026-21959 | Analyzed | 未確認 | CWE-284 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable v |
| CVE-2026-21960 | Analyzed | 未確認 | CWE-284 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitabl |
| CVE-2026-21961 | Analyzed | 未確認 | CWE-284 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot). The supported version |
| CVE-2026-21962 | Analyzed | 掲載 | CWE-284 | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, |
| CVE-2026-21963 | Analyzed | 未確認 | CWE-269 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner |
| CVE-2026-21964 | Analyzed | 未確認 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. | |
| CVE-2026-21965 | Analyzed | 未確認 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerabili | |
| CVE-2026-21966 | Analyzed | 未確認 | Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Supported versions that are affected are 5.6.19.23 | |
| CVE-2026-21967 | Analyzed | 未確認 | Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.23, 5.6.25.1 | |
| CVE-2026-21968 | Analyzed | 未確認 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easi | |
| CVE-2026-21969 | Analyzed | 未確認 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal). The supported version that is affected is | |
| CVE-2026-21970 | Analyzed | 未確認 | Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0 | |
| CVE-2026-21971 | Analyzed | 未確認 | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable | |
| CVE-2026-21972 | Analyzed | 未確認 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitabl | |
| CVE-2026-21973 | Analyzed | 未確認 | Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle Financial Services Applications (component: Security Management System). Supported versions that are affe | |
| CVE-2026-21974 | Analyzed | 未確認 | CWE-200 | Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0 |
| CVE-2026-21975 | Analyzed | 未確認 | CWE-404 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.29 and 21.3-21.20. Easily exploitable vulnerability allows high |
| CVE-2026-21976 | Analyzed | 未確認 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud). Supported versions that are affected are 7.6. | |
| CVE-2026-21977 | Deferred | 未確認 | Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security). Supported versions that are affec | |
| CVE-2026-21978 | Analyzed | 未確認 | Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Relationship Pricing). Supported versions that are affected ar | |
| CVE-2026-21979 | Deferred | 未確認 | Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). The supported version that is affected is 25.04.07. Easily exp | |
| CVE-2026-21980 | Analyzed | 未確認 | Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0. | |
| CVE-2026-21981 | Analyzed | 未確認 | CWE-269 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner |
| CVE-2026-21982 | Analyzed | 未確認 | CWE-284 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vuln |
| CVE-2026-21983 | Analyzed | 未確認 | CWE-269 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vuln |
| CVE-2026-21984 | Analyzed | 未確認 | CWE-284 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vuln |
| CVE-2026-21985 | Analyzed | 未確認 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner | |
| CVE-2026-21986 | Analyzed | 未確認 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner | |
| CVE-2026-21987 | Analyzed | 未確認 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner | |
| CVE-2026-21988 | Analyzed | 未確認 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner | |
| CVE-2026-21989 | Analyzed | 未確認 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner | |
| CVE-2026-21990 | Analyzed | 未確認 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulner | |
| CVE-2026-22022 | Analyzed | 未確認 | CWE-285 | Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to in |
| CVE-2026-22023 | Analyzed | 未確認 | CWE-125 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-22024 | Analyzed | 未確認 | CWE-401 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-22025 | Analyzed | 未確認 | CWE-401, CWE-770 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-22026 | Analyzed | 未確認 | CWE-789 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-22027 | Analyzed | 未確認 | CWE-122 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-22028 | Analyzed | 未確認 | CWE-843 | Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced i |
| CVE-2026-22029 | Modified | 未確認 | CWE-79 | React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects |
| CVE-2026-22030 | Analyzed | 未確認 | CWE-346, CWE-352 | React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF at |
| CVE-2026-22031 | Analyzed | 未確認 | CWE-177 | @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware regist |
| CVE-2026-22032 | Analyzed | 未確認 | CWE-601 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication |
| CVE-2026-22033 | Analyzed | 未確認 | CWE-284, CWE-79 | Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys fun |
| CVE-2026-22034 | Analyzed | 未確認 | CWE-636 | Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to v |
| CVE-2026-22035 | Analyzed | 未確認 | CWE-78 | Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments |
| CVE-2026-22036 | Modified | 未確認 | CWE-770 | Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious s |
| CVE-2026-22037 | Deferred | 未確認 | CWE-177, CWE-288 | The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with |
| CVE-2026-22039 | Analyzed | 未確認 | CWE-269, CWE-918 | Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyv |
| CVE-2026-22041 | Analyzed | 未確認 | CWE-704 | Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to version 0.0.6, non-string types are conver |
| CVE-2026-22042 | Analyzed | 未確認 | CWE-285, CWE-863 | RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `Imp |
| CVE-2026-22043 | Analyzed | 未確認 | CWE-269, CWE-284, CWE-522 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted |
| CVE-2026-22045 | Analyzed | 未確認 | CWE-770 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME |
| CVE-2026-22046 | Analyzed | 未確認 | CWE-130, CWE-20, CWE-252, CWE-787, CWE-843 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-22047 | Analyzed | 未確認 | CWE-130, CWE-20, CWE-252, CWE-787 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-22050 | Analyzed | 未確認 | CWE-639 | ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker |
| CVE-2026-22079 | Deferred | 未確認 | CWE-319 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credentials during the initia |
| CVE-2026-22080 | Deferred | 未確認 | CWE-319 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 e |
| CVE-2026-22081 | Deferred | 未確認 | CWE-1004 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the |
| CVE-2026-22082 | Deferred | 未確認 | CWE-384 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session ID through its web-ba |
| CVE-2026-22156 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22157 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22158 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22159 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22160 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22161 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22162 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22184 | Modified | 未確認 | CWE-120, CWE-787 | zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstr |
| CVE-2026-22185 | Deferred | 未確認 | CWE-125, CWE-191 | OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_loa |
| CVE-2026-22186 | Modified | 未確認 | CWE-611 | Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses |
| CVE-2026-22187 | Analyzed | 未確認 | CWE-502 | Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.format |
| CVE-2026-22188 | Modified | 未確認 | CWE-457, CWE-789, CWE-908 | The deploy-stub component in Panda3D versions up to and including 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable a |
| CVE-2026-22189 | Modified | 未確認 | CWE-121, CWE-787 | The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker- |
| CVE-2026-22190 | Modified | 未確認 | CWE-134 | The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used dir |
| CVE-2026-22194 | Analyzed | 未確認 | CWE-352 | GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An |
| CVE-2026-22195 | Analyzed | 未確認 | CWE-89 | GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without suffic |
| CVE-2026-22196 | Analyzed | 未確認 | CWE-89 | GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into |
| CVE-2026-22197 | Analyzed | 未確認 | CWE-89 | GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets |
| CVE-2026-22198 | Analyzed | 未確認 | CWE-79 | GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with |
| CVE-2026-22200 | Analyzed | 未確認 | CWE-74 | Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attack |
| CVE-2026-22211 | Deferred | 未確認 | CWE-787 | TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 ne |
| CVE-2026-22212 | Deferred | 未確認 | CWE-121 | TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy() and |
| CVE-2026-22213 | Analyzed | 未確認 | CWE-121 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string con |
| CVE-2026-22214 | Analyzed | 未確認 | CWE-121 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incom |
| CVE-2026-22218 | Analyzed | 未確認 | CWE-22 | Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-con |
| CVE-2026-22219 | Analyzed | 未確認 | CWE-918 | Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backe |
| CVE-2026-22230 | Analyzed | 未確認 | CWE-863 | OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an |
| CVE-2026-22231 | Analyzed | 未確認 | CWE-79 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whenever another user vi |
| CVE-2026-22232 | Analyzed | 未確認 | CWE-79 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever an |
| CVE-2026-22233 | Analyzed | 未確認 | CWE-79 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever another user visits th |
| CVE-2026-22234 | Analyzed | 未確認 | CWE-639 | OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and do |
| CVE-2026-22235 | Analyzed | 未確認 | CWE-639 | OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any u |
| CVE-2026-22236 | Analyzed | 未確認 | CWE-287 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerability by sending spe |
| CVE-2026-22237 | Analyzed | 未確認 | CWE-200 | The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending spe |
| CVE-2026-22238 | Analyzed | 未確認 | CWE-269, CWE-306 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending speci |
| CVE-2026-22239 | Analyzed | 未確認 | CWE-400 | The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted |
| CVE-2026-22240 | Analyzed | 未確認 | CWE-200, CWE-312, CWE-522 | The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could e |
| CVE-2026-22241 | Modified | 未確認 | CWE-434 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import f |
| CVE-2026-22242 | Analyzed | 未確認 | CWE-564, CWE-89 | CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator- |
| CVE-2026-22243 | Analyzed | 未確認 | CWE-89 | EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.202601 |
| CVE-2026-22244 | Modified | 未確認 | CWE-1336, CWE-94 | OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email tem |
| CVE-2026-22245 | Analyzed | 未確認 | CWE-918 | Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has |
| CVE-2026-22246 | Analyzed | 未確認 | CWE-201 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationshi |
| CVE-2026-22249 | Analyzed | 未確認 | CWE-22 | Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip |
| CVE-2026-22250 | Analyzed | 未確認 | CWE-295 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0. |
| CVE-2026-22251 | Analyzed | 未確認 | CWE-200 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, b |
| CVE-2026-22252 | Analyzed | 未確認 | CWE-285 | LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticate |
| CVE-2026-22253 | Analyzed | 未確認 | CWE-863 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with |
| CVE-2026-22255 | Analyzed | 未確認 | CWE-130, CWE-20, CWE-252 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio |
| CVE-2026-22256 | Analyzed | 未確認 | CWE-79 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder which include a render of the current path, in which its in |
| CVE-2026-22257 | Analyzed | 未確認 | CWE-79 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may pot |
| CVE-2026-22258 | Analyzed | 未確認 | CWE-400, CWE-770 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaus |
| CVE-2026-22259 | Analyzed | 未確認 | CWE-400, CWE-770 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP |
| CVE-2026-22260 | Analyzed | 未確認 | CWE-674, CWE-787 | Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash with a stack overflow. Version 8.0.3 patches the issue. As a |
| CVE-2026-22261 | Analyzed | 未確認 | CWE-1050 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered in a tx, can lead to |
| CVE-2026-22262 | Analyzed | 未確認 | CWE-121, CWE-787 | Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the data in the dataset is |
| CVE-2026-22263 | Analyzed | 未確認 | CWE-1050 | Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packet |
| CVE-2026-22264 | Analyzed | 未確認 | CWE-416 | Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive |
| CVE-2026-22265 | Analyzed | 未確認 | CWE-78 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality tha |
| CVE-2026-22271 | Analyzed | 未確認 | CWE-319 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive Information vulnerability. An unauthentic |
| CVE-2026-22273 | Analyzed | 未確認 | CWE-1392 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Use of Default Credentials vulnerability in the OS. A low privileged attacke |
| CVE-2026-22274 | Analyzed | 未確認 | CWE-319 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive Information vulnerability in the Fabric S |
| CVE-2026-22275 | Analyzed | 未確認 | CWE-540 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Inclusion of Sensitive Information in Source Code vulnerability. A low privi |
| CVE-2026-22276 | Analyzed | 未確認 | CWE-312 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged at |
| CVE-2026-22277 | Analyzed | 未確認 | CWE-78 | Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged at |
| CVE-2026-22278 | Analyzed | 未確認 | CWE-307 | Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. An unauthenticated attacker with remote access |
| CVE-2026-22279 | Analyzed | 未確認 | CWE-778 | Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulner |
| CVE-2026-22280 | Analyzed | 未確認 | CWE-732 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0 |
| CVE-2026-22281 | Analyzed | 未確認 | CWE-367 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0 |
| CVE-2026-22347 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider carousel-horizontal-pos |
| CVE-2026-22348 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe |
| CVE-2026-22349 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In Post menu-in-post allows DOM-Based XSS.This issue affects Me |
| CVE-2026-22353 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress teachpress allows Stored XSS.This issue affects teachPress: |
| CVE-2026-22355 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in gregmolnar Simple XML Sitemap simple-xml-sitemap allows Stored XSS.This issue affects Simple XML Sitemap: from n/a through <= 1.3 |
| CVE-2026-22358 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.This issue affects Elect |
| CVE-2026-22359 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross Site Request Forgery.This issue affects Wordpress Movies Bulk |
| CVE-2026-22360 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a through <= 1.4. |
| CVE-2026-22382 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affect |
| CVE-2026-22388 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Carousel WP owl-carousel-wp allows Stored XSS.This issue affects |
| CVE-2026-22391 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec |
| CVE-2026-22393 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec |
| CVE-2026-22396 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2026-22398 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec |
| CVE-2026-22400 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff |
| CVE-2026-22401 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Freshio freshio allows PHP Local File Inclusion. |
| CVE-2026-22402 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Triply triply allows PHP Local File Inclusion.Th |
| CVE-2026-22404 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a |
| CVE-2026-22406 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a |
| CVE-2026-22407 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2026-22409 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2026-22411 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a |
| CVE-2026-22426 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This is |
| CVE-2026-22430 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a |
| CVE-2026-22444 | Analyzed | 未確認 | CWE-20 | The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read |
| CVE-2026-22445 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connec |
| CVE-2026-22447 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prowess: from n/a th |
| CVE-2026-22450 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n |
| CVE-2026-22458 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wanderland: fr |
| CVE-2026-22461 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2026-22462 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in richardevcom Add Polylang support for Customizer add-polylang-support-for-customizer allows Cross Site Request Forgery.This issue |
| CVE-2026-22463 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.company Form to Chat App form-to-chat allows Stored XSS.This issue affec |
| CVE-2026-22464 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-editio |
| CVE-2026-22466 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP MapIt: from n/a |
| CVE-2026-22468 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This is |
| CVE-2026-22469 | Deferred | 未確認 | CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This issue affects DeepDigi |
| CVE-2026-22470 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin all |
| CVE-2026-22472 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2026-22481 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker allows Exploiting Incorrectly Configured Access Control Secu |
| CVE-2026-22482 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through <= 2.3.12. |
| CVE-2026-22483 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in winkm89 teachPress teachpress allows Cross Site Request Forgery.This issue affects teachPress: from n/a through <= 9.0.12. |
| CVE-2026-22486 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery: from n/a through 1.18.9. |
| CVE-2026-22487 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in baqend Speed Kit baqend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Speed Kit: from n/a throug |
| CVE-2026-22488 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access C |
| CVE-2026-22489 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Wptexture Image Slider Slideshow image-slider-slideshow allows Exploiting Incorrectly Configured Access Control Se |
| CVE-2026-22490 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access Control Security Leve |
| CVE-2026-22492 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Docket Cac |
| CVE-2026-22517 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.Thi |
| CVE-2026-22518 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows DOM-Based XSS.This i |
| CVE-2026-22519 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This issue affects MediaPress |
| CVE-2026-22521 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-framework allows PHP Lo |
| CVE-2026-22522 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Block Slider |
| CVE-2026-22535 | Deferred | 未確認 | CWE-1366 | An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the se |
| CVE-2026-22536 | Deferred | 未確認 | CWE-269 | The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions |
| CVE-2026-22537 | Deferred | 未確認 | CWE-497 | The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for |
| CVE-2026-22539 | Deferred | 未確認 | CWE-201 | As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6. |
| CVE-2026-22540 | Deferred | 未確認 | CWE-400 | The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for |
| CVE-2026-22541 | Deferred | 未確認 | CWE-400 | The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating cor |
| CVE-2026-22542 | Deferred | 未確認 | CWE-400 | An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service. |
| CVE-2026-22543 | Deferred | 未確認 | CWE-261 | The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept t |
| CVE-2026-22544 | Deferred | 未確認 | CWE-319 | An attacker with a network connection could detect credentials in clear text. |
| CVE-2026-22577 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22578 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22579 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22580 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22581 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22582 | Analyzed | 未確認 | CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services |
| CVE-2026-22583 | Analyzed | 未確認 | CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services |
| CVE-2026-22584 | Analyzed | 未確認 | CWE-94 | Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This i |
| CVE-2026-22585 | Analyzed | 未確認 | CWE-327 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub |
| CVE-2026-22586 | Analyzed | 未確認 | CWE-321 | Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Web |
| CVE-2026-22587 | Deferred | 未確認 | CWE-79 | Ideagen DevonWay contains a stored cross site scripting vulnerability. A remote, authenticated attacker could craft a payload in the 'Reports' page that executes when another user |
| CVE-2026-22588 | Analyzed | 未確認 | CWE-639 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vu |
| CVE-2026-22589 | Analyzed | 未確認 | CWE-639 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) |
| CVE-2026-22594 | Analyzed | 未確認 | CWE-287 | Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip emai |
| CVE-2026-22595 | Analyzed | 未確認 | CWE-863 | Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowe |
| CVE-2026-22596 | Analyzed | 未確認 | CWE-89 | Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allow |
| CVE-2026-22597 | Analyzed | 未確認 | CWE-918 | Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in |
| CVE-2026-22598 | Deferred | 未確認 | CWE-20 | ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and |
| CVE-2026-22600 | Analyzed | 未確認 | CWE-200 | OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior |
| CVE-2026-22601 | Analyzed | 未確認 | CWE-77 | OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configur |
| CVE-2026-22602 | Analyzed | 未確認 | CWE-200 | OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user ID |
| CVE-2026-22603 | Analyzed | 未確認 | CWE-307 | OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint (/account/change_password) was |
| CVE-2026-22604 | Analyzed | 未確認 | CWE-200 | OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_pass |
| CVE-2026-22605 | Analyzed | 未確認 | CWE-284 | OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, |
| CVE-2026-22606 | Analyzed | 未確認 | CWE-184, CWE-502 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicious |
| CVE-2026-22607 | Analyzed | 未確認 | CWE-184, CWE-502 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Because of this, a malici |
| CVE-2026-22608 | Analyzed | 未確認 | CWE-184, CWE-502 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning t |
| CVE-2026-22609 | Analyzed | 未確認 | CWE-184, CWE-502 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Pyth |
| CVE-2026-22610 | Modified | 未確認 | CWE-79 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and |
| CVE-2026-22611 | Deferred | 未確認 | CWE-20 | AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, C |
| CVE-2026-22612 | Analyzed | 未確認 | CWE-502 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been pa |
| CVE-2026-22623 | Deferred | 未確認 | CWE-77 | Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specif |
| CVE-2026-22624 | Deferred | 未確認 | CWE-863 | Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization. |
| CVE-2026-22625 | Deferred | 未確認 | CWE-22 | Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files. |
| CVE-2026-22626 | Deferred | 未確認 | CWE-233 | Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific message |
| CVE-2026-22630 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22631 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22632 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22633 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22634 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22635 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22636 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22637 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22638 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22639 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22640 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22641 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22642 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22643 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22644 | Analyzed | 未確認 | CWE-598 | Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could |
| CVE-2026-22645 | Analyzed | 未確認 | CWE-200 | The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities |
| CVE-2026-22646 | Analyzed | 未確認 | CWE-209 | Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance informat |
| CVE-2026-22685 | Analyzed | 未確認 | CWE-22 | DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When pro |
| CVE-2026-22686 | Analyzed | 未確認 | CWE-693, CWE-94 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrust |
| CVE-2026-22687 | Modified | 未確認 | CWE-89 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent service, it allows user |
| CVE-2026-22688 | Analyzed | 未確認 | CWE-77 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows |
| CVE-2026-22689 | Analyzed | 未確認 | CWE-1385 | Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin. This lack of Ori |
| CVE-2026-22690 | Analyzed | 未確認 | CWE-400 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who |
| CVE-2026-22691 | Analyzed | 未確認 | CWE-1333, CWE-400 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability c |
| CVE-2026-22693 | Analyzed | 未確認 | CWE-476 | HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap- |
| CVE-2026-22694 | Analyzed | 未確認 | CWE-346 | AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Andro |
| CVE-2026-22695 | Analyzed | 未確認 | CWE-125 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap b |
| CVE-2026-22696 | Deferred | 未確認 | CWE-295, CWE-347 | dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cr |
| CVE-2026-22697 | Analyzed | 未確認 | CWE-122 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running |
| CVE-2026-22698 | Analyzed | 未確認 | CWE-331 | RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, |
| CVE-2026-22699 | Analyzed | 未確認 | CWE-20 | RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, |
| CVE-2026-22700 | Analyzed | 未確認 | CWE-20 | RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, |
| CVE-2026-22701 | Analyzed | 未確認 | CWE-362, CWE-367, CWE-59 | filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock pa |
| CVE-2026-22702 | Analyzed | 未確認 | CWE-362, CWE-59 | virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attac |
| CVE-2026-22703 | Analyzed | 未確認 | CWE-345 | Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even i |
| CVE-2026-22704 | Analyzed | 未確認 | CWE-79 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. |
| CVE-2026-22705 | Deferred | 未確認 | CWE-1240 | RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel |
| CVE-2026-22708 | Analyzed | 未確認 | CWE-15, CWE-269, CWE-74, CWE-77, CWE-78, CWE-94 | Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still |
| CVE-2026-22709 | Analyzed | 未確認 | CWE-693, CWE-913, CWE-94 | vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows |
| CVE-2026-22710 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Si |
| CVE-2026-22712 | Analyzed | 未確認 | CWE-116 | Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input D |
| CVE-2026-22713 | Analyzed | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows |
| CVE-2026-22714 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scri |
| CVE-2026-22718 | Deferred | 未確認 | CWE-78 | The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine. |
| CVE-2026-22755 | Deferred | 未確認 | CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9 |
| CVE-2026-22764 | Analyzed | 未確認 | CWE-287 | Dell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploi |
| CVE-2026-22770 | Analyzed | 未確認 | CWE-763 | ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBil |
| CVE-2026-22771 | Modified | 未確認 | CWE-94 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts |
| CVE-2026-22772 | Analyzed | 未確認 | CWE-918 | Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, |
| CVE-2026-22773 | Analyzed | 未確認 | CWE-770 | vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving multimodal models that us |
| CVE-2026-22774 | Modified | 未確認 | CWE-405 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.p |
| CVE-2026-22775 | Modified | 未確認 | CWE-405 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.p |
| CVE-2026-22776 | Analyzed | 未確認 | CWE-409 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the |
| CVE-2026-22777 | Analyzed | 未確認 | CWE-93 | ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query paramete |
| CVE-2026-22779 | Analyzed | 未確認 | CWE-113 | BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF in |
| CVE-2026-22781 | Analyzed | 未確認 | CWE-78 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query paramet |
| CVE-2026-22782 | Analyzed | 未確認 | CWE-532 | RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and exp |
| CVE-2026-22783 | Analyzed | 未確認 | CWE-434, CWE-73, CWE-915 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system h |
| CVE-2026-22784 | Analyzed | 未確認 | CWE-863 | Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain |
| CVE-2026-22785 | Analyzed | 未確認 | CWE-77 | orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulat |
| CVE-2026-22786 | Analyzed | 未確認 | CWE-22, CWE-434 | Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attac |
| CVE-2026-22787 | Analyzed | 未確認 | CWE-79 | html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a |
| CVE-2026-22788 | Analyzed | 未確認 | CWE-306 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints withou |
| CVE-2026-22789 | Analyzed | 未確認 | CWE-434, CWE-616 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multi |
| CVE-2026-22791 | Analyzed | 未確認 | CWE-131 | openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allow |
| CVE-2026-22792 | Analyzed | 未確認 | CWE-116 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits untrusted HTML (incl |
| CVE-2026-22793 | Analyzed | 未確認 | CWE-94 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts |
| CVE-2026-22794 | Analyzed | 未確認 | CWE-346 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl wit |
| CVE-2026-22795 | Modified | 未確認 | CWE-754 | Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS# |
| CVE-2026-22796 | Modified | 未確認 | CWE-754 | Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the ty |
| CVE-2026-22797 | Deferred | 未確認 | CWE-290 | An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_to |
| CVE-2026-22798 | Analyzed | 未確認 | CWE-532 | hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options unde |
| CVE-2026-22799 | Analyzed | 未確認 | CWE-434 | Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to imp |
| CVE-2026-22800 | Analyzed | 未確認 | CWE-352 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative |
| CVE-2026-22801 | Analyzed | 未確認 | CWE-125, CWE-190 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integ |
| CVE-2026-22803 | Analyzed | 未確認 | CWE-770, CWE-789 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data fo |
| CVE-2026-22804 | Analyzed | 未確認 | CWE-269, CWE-79 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 to 1.9.0, Stored Cross-Site Scripting (XSS) vulnerability e |
| CVE-2026-22805 | Analyzed | 未確認 | CWE-918 | Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially imp |
| CVE-2026-22806 | Deferred | 未確認 | CWE-863 | vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an acces |
| CVE-2026-22807 | Modified | 未確認 | CWE-94 | vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules |
| CVE-2026-22808 | Analyzed | 未確認 | CWE-79 | fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can ex |
| CVE-2026-22809 | Analyzed | 未確認 | CWE-1333 | tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in th |
| CVE-2026-22812 | Analyzed | 未確認 | CWE-306, CWE-749, CWE-942 | OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permiss |
| CVE-2026-22813 | Analyzed | 未確認 | CWE-79 | OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a |
| CVE-2026-22814 | Deferred | 未確認 | CWE-915 | @adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a rem |
| CVE-2026-22816 | Analyzed | 未確認 | CWE-494, CWE-829 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were n |
| CVE-2026-22817 | Analyzed | 未確認 | CWE-347 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JW |
| CVE-2026-22818 | Analyzed | 未確認 | CWE-347 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the al |
| CVE-2026-22819 | Analyzed | 未確認 | CWE-366 | Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction loc |
| CVE-2026-22820 | Analyzed | 未確認 | CWE-367 | Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This |
| CVE-2026-22822 | Modified | 未確認 | CWE-863 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2 and prior to version |
| CVE-2026-22829 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22830 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22831 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22832 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22833 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22834 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22835 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22836 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22837 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-22844 | Deferred | 未確認 | CWE-78 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via n |
| CVE-2026-22849 | Analyzed | 未確認 | CWE-79, CWE-83 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML wit |
| CVE-2026-22850 | Analyzed | 未確認 | CWE-89 | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics export/import and per |
| CVE-2026-22851 | Analyzed | 未確認 | CWE-362, CWE-416 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads |
| CVE-2026-22852 | Analyzed | 未確認 | CWE-787 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when process |
| CVE-2026-22853 | Modified | 未確認 | CWE-787 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can wr |
| CVE-2026-22854 | Analyzed | 未確認 | CWE-122 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read f |
| CVE-2026-22855 | Modified | 未確認 | CWE-125 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the |
| CVE-2026-22856 | Analyzed | 未確認 | CWE-362, CWE-416 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread remo |
| CVE-2026-22857 | Analyzed | 未確認 | CWE-416 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and th |
| CVE-2026-22858 | Modified | 未確認 | CWE-125, CWE-758, CWE-787 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to b |
| CVE-2026-22859 | Modified | 未確認 | CWE-125, CWE-129 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR v |
| CVE-2026-22861 | Analyzed | 未確認 | CWE-120, CWE-130, CWE-252, CWE-787 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior |
| CVE-2026-22862 | Analyzed | 未確認 | CWE-20 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vu |
| CVE-2026-22863 | Analyzed | 未確認 | CWE-325 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. Thi |
| CVE-2026-22864 | Analyzed | 未確認 | CWE-77 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s |
| CVE-2026-22865 | Analyzed | 未確認 | CWE-494, CWE-829 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were n |
| CVE-2026-22867 | Analyzed | 未確認 | CWE-79 | LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking featu |
| CVE-2026-22868 | Analyzed | 未確認 | CWE-20 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vu |
| CVE-2026-22869 | Analyzed | 未確認 | CWE-94 | Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pull requests with repo |
| CVE-2026-22870 | Analyzed | 未確認 | CWE-409 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archive |
| CVE-2026-22871 | Analyzed | 未確認 | CWE-22 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicio |
| CVE-2026-22876 | Deferred | 未確認 | CWE-22 | Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If this vulnerability is exploited, arbitrary files on the affected pr |
| CVE-2026-22907 | Analyzed | 未確認 | CWE-266 | An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data. |
| CVE-2026-22908 | Analyzed | 未確認 | CWE-266 | Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality. |
| CVE-2026-22909 | Analyzed | 未確認 | CWE-284, CWE-863 | Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations |
| CVE-2026-22910 | Analyzed | 未確認 | CWE-1391 | The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the |
| CVE-2026-22911 | Analyzed | 未確認 | CWE-522, CWE-798 | Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device. |
| CVE-2026-22912 | Analyzed | 未確認 | CWE-601 | Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credenti |
| CVE-2026-22913 | Analyzed | 未確認 | CWE-79 | Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data. |
| CVE-2026-22914 | Analyzed | 未確認 | CWE-266 | An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation. |
| CVE-2026-22915 | Analyzed | 未確認 | CWE-497 | An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information. |
| CVE-2026-22916 | Analyzed | 未確認 | CWE-266 | An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disrupt |
| CVE-2026-22917 | Analyzed | 未確認 | CWE-770 | Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service. |
| CVE-2026-22918 | Analyzed | 未確認 | CWE-1021 | An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extractio |
| CVE-2026-22919 | Analyzed | 未確認 | CWE-79 | An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensi |
| CVE-2026-22920 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-22976 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q |
| CVE-2026-22977 | Modified | 未確認 | CWE-400, CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining |
| CVE-2026-22978 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point struct iw_point has a 32bit hole on 64bit arches. struct iw_ | |
| CVE-2026-22979 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwa |
| CVE-2026-22980 | Modified | 未確認 | CWE-362, CWE-416 | In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in mem |
| CVE-2026-22981 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: idpf: detach and close netdevs while handling a reset Protect the reset path from callbacks by setting the net |
| CVE-2026-22982 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix crash when adding interface under a lag Commit 15faa1f67ab4 ("lan966x: Fix crash when a |
| CVE-2026-22983 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net: do not write to msg_get_inq in callee NULL pointer dereference fix. msg_get_inq is an input field from c |
| CVE-2026-22984 | Modified | 未確認 | CWE-125 | In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on paylo |
| CVE-2026-22985 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the inte |
| CVE-2026-22986 | Modified | 未確認 | CWE-362 | In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_add_data_with_key(), one may b |
| CVE-2026-22987 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot reported a crash in tc_act_in_hw |
| CVE-2026-22988 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() call | |
| CVE-2026-22989 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesystem If we are trying to unlock the filesystem via an admin | |
| CVE-2026-22990 | Modified | 未確認 | CWE-400, CWE-617 | In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted suc |
| CVE-2026-22991 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to partial allocation free_choose_arg_map() may dereference a NU |
| CVE-2026-22992 | Modified | 未確認 | CWE-476, CWE-754 | In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() Currently any error from ceph_auth_handle_reply_ |
| CVE-2026-22993 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL ptr issue after soft reset During soft reset, the RSS LUT is freed and not restored unl |
| CVE-2026-22994 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting | |
| CVE-2026-22995 | Analyzed | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan |
| CVE-2026-22996 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv mlx5e_priv is an unstable structure that can be me |
| CVE-2026-22997 | Modified | 未確認 | CWE-772 | In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Since j19 |
| CVE-2026-22998 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a ke |
| CVE-2026-22999 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl- |
| CVE-2026-23000 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash on profile change rollback failure mlx5e_netdev_change_profile can fail to attach a new p |
| CVE-2026-23001 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vla |
| CVE-2026-23002 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer de |
| CVE-2026-23003 | Modified | 未確認 | CWE-457, CWE-908 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulati |
| CVE-2026-23004 | Modified | 未確認 | CWE-362, CWE-416 | In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt |
| CVE-2026-23005 | Modified | 未確認 | CWE-20 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_ |
| CVE-2026-23006 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: ASoC: tlv320adcx140: fix null pointer The "snd_soc_component" in "adcx140_priv" was only used once but never s |
| CVE-2026-23007 | Modified | 未確認 | CWE-908 | In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be |
| CVE-2026-23008 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix KMS with 3D on HW version 10 HW version 10 does not have GB Surfaces so there is no backing bu |
| CVE-2026-23009 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: don't dereference freed ring when removing sideband endpoint xhci_sideband_remove_endpoint() i | |
| CVE-2026-23010 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del |
| CVE-2026-23011 | Modified | 未確認 | CWE-119 | In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust" |
| CVE-2026-23012 | Analyzed | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: remove call_control in inactive contexts If damon_call() is executed against a DAMON context th |
| CVE-2026-23013 | Modified | 未確認 | CWE-416 | In the Linux kernel, the following vulnerability has been resolved: net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback octep_vf_request_irqs() requests MSI-X queue I |
| CVE-2026-23014 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: perf: Ensure swevent hrtimer is properly destroyed With the change to hrtimer_try_to_cancel() in perf_swevent_ | |
| CVE-2026-23015 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths The reference obtained by calling usb_get_de | |
| CVE-2026-23016 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: drop fraglist conntrack references Jakub added a warning in nf_conntrack_cleanup_net_list() to ma | |
| CVE-2026-23017 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix error handling in the init_task on load If the init_task fails during a driver load, we end up witho |
| CVE-2026-23018 | Analyzed | 未確認 | In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before initializing extent tree in btrfs_read_locked_inode() In btrfs_read_locked_inode() | |
| CVE-2026-23019 | Modified | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix NULL dereference on devlink_alloc() failure devlink_alloc() may return NULL on all |
| CVE-2026-23020 | Analyzed | 未確認 | CWE-476 | In the Linux kernel, the following vulnerability has been resolved: net: 3com: 3c59x: fix possible null dereference in vortex_probe1() pdev can be null and free_ring: can be call |
| CVE-2026-23021 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: fix memory leak in update_eth_regs_async() When asynchronously writing to the device regist |
| CVE-2026-23022 | Analyzed | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leak in idpf_vc_core_deinit() Make sure to free hw->lan_regs. Reported by kmemleak during res |
| CVE-2026-23023 | Analyzed | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leak in idpf_vport_rel() Free vport->rx_ptype_lkup in idpf_vport_rel() to avoid leaking memor |
| CVE-2026-23024 | Analyzed | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leak of flow steer list on rmmod The flow steering list maintains entries that are added and |
| CVE-2026-23025 | Modified | 未確認 | In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock f | |
| CVE-2026-23026 | Modified | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() Fix a memory leak in gpi_peripheral_config() |
| CVE-2026-23027 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() In kvm_ioctl_create_device(), kvm_device has allo | |
| CVE-2026-23028 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() In kvm_ioctl_create_device(), kvm_device has allocate | |
| CVE-2026-23029 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() In kvm_ioctl_create_device(), kvm_device has allo | |
| CVE-2026-23030 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() The for_each_available_child_of_no | |
| CVE-2026-23031 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak In gs_can_open(), the URBs for USB-in transfe | |
| CVE-2026-23032 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: null_blk: fix kmemleak by releasing references to fault configfs items When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJE | |
| CVE-2026-23033 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: omap-dma: fix dma_pool resource leak in error paths The dma_pool created by dma_pool_create() is no | |
| CVE-2026-23034 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 The user mode queue keeps a pointer to the mos | |
| CVE-2026-23035 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv mlx5e_priv is an unstable structure that can be | |
| CVE-2026-23036 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before iget_failed() in btrfs_read_locked_inode() In btrfs_read_locked_inode() if we fail | |
| CVE-2026-23037 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: allow partial RX URB allocation to succeed When es58x_alloc_rx_urbs() fails to allocate the r | |
| CVE-2026-23038 | Deferred | 未確認 | CWE-401 | In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allo |
| CVE-2026-23039 | Deferred | 未確認 | In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix NULL fb and crtc dereferences on USB disconnect On disconnect drm_atomic_helper_disable_all() is | |
| CVE-2026-23477 | Analyzed | 未確認 | CWE-269, CWE-862 | Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to a |
| CVE-2026-23478 | Analyzed | 未確認 | CWE-602, CWE-639 | Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated |
| CVE-2026-23490 | Modified | 未確認 | CWE-770 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive co |
| CVE-2026-23492 | Analyzed | 未確認 | CWE-89 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated |
| CVE-2026-23493 | Analyzed | 未確認 | CWE-532 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensit |
| CVE-2026-23494 | Analyzed | 未確認 | CWE-284 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API en |
| CVE-2026-23495 | Analyzed | 未確認 | CWE-284 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequa |
| CVE-2026-23496 | Analyzed | 未確認 | CWE-284, CWE-863 | Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side authorization checks |
| CVE-2026-23497 | Analyzed | 未確認 | CWE-79 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially |
| CVE-2026-23498 | Analyzed | 未確認 | CWE-94 | Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow |
| CVE-2026-23499 | Analyzed | 未確認 | CWE-434, CWE-79 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or Apps to upload arbitra |
| CVE-2026-23511 | Analyzed | 未確認 | CWE-204 | ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthentic |
| CVE-2026-23512 | Analyzed | 未確認 | CWE-426 | SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application exec |
| CVE-2026-23516 | Analyzed | 未確認 | CWE-79, CWE-83 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a v |
| CVE-2026-23517 | Analyzed | 未確認 | CWE-862 | Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access |
| CVE-2026-23518 | Analyzed | 未確認 | CWE-347 | Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow |
| CVE-2026-23519 | Analyzed | 未確認 | CWE-203, CWE-208 | RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior |
| CVE-2026-23520 | Analyzed | 未確認 | CWE-78 | Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcanea |
| CVE-2026-23522 | Deferred | 未確認 | CWE-284, CWE-639, CWE-862, CWE-915 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticated users to delete fil |
| CVE-2026-23523 | Analyzed | 未確認 | CWE-94 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP se |
| CVE-2026-23524 | Analyzed | 未確認 | CWE-502 | Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into P |
| CVE-2026-23525 | Analyzed | 未確認 | CWE-79 | 1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store when viewing applica |
| CVE-2026-23526 | Analyzed | 未確認 | CWE-267 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their p |
| CVE-2026-23527 | Modified | 未確認 | CWE-444 | H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a stric |
| CVE-2026-23528 | Analyzed | 未確認 | CWE-250, CWE-79, CWE-80 | Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to c |
| CVE-2026-23529 | Deferred | 未確認 | CWE-73, CWE-918 | Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file read in Google BigQuery |
| CVE-2026-23530 | Modified | 未確認 | CWE-122 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `plan |
| CVE-2026-23531 | Modified | 未確認 | CWE-122 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_n |
| CVE-2026-23532 | Modified | 未確認 | CWE-122 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` |
| CVE-2026-23533 | Modified | 未確認 | CWE-122 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when malici |
| CVE-2026-23534 | Modified | 未確認 | CWE-122 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted |
| CVE-2026-23535 | Analyzed | 未確認 | CWE-22 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted ser |
| CVE-2026-23550 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1. |
| CVE-2026-23553 | Analyzed | 未確認 | CWE-665, CWE-693 | In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between v |
| CVE-2026-23563 | Analyzed | 未確認 | CWE-59 | Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a |
| CVE-2026-23564 | Analyzed | 未確認 | CWE-319 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent netwo |
| CVE-2026-23565 | Analyzed | 未確認 | CWE-476 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent netwo |
| CVE-2026-23566 | Analyzed | 未確認 | CWE-20 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent netwo |
| CVE-2026-23567 | Analyzed | 未確認 | CWE-122 | An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allo |
| CVE-2026-23568 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attack |
| CVE-2026-23569 | Analyzed | 未確認 | CWE-125 | An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows a remote |
| CVE-2026-23570 | Analyzed | 未確認 | CWE-20 | A missing validation of a user-controlled value in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allo |
| CVE-2026-23571 | Analyzed | 未確認 | CWE-20 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allo |
| CVE-2026-23574 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23575 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23576 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23577 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23578 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23579 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23580 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23581 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23582 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23592 | Deferred | 未確認 | CWE-78 | Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated attackers to achieve remote code execution. Successful exploitat |
| CVE-2026-23593 | Deferred | 未確認 | CWE-22 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful e |
| CVE-2026-23622 | Analyzed | 未確認 | CWE-352 | Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns ear |
| CVE-2026-23625 | Analyzed | 未確認 | CWE-79 | OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view |
| CVE-2026-23626 | Analyzed | 未確認 | CWE-1336 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`Def |
| CVE-2026-23630 | Analyzed | 未確認 | CWE-116, CWE-79 | Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (X |
| CVE-2026-23634 | Analyzed | 未確認 | CWE-272 | Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for modul |
| CVE-2026-23643 | Analyzed | 未確認 | CWE-79 | CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This |
| CVE-2026-23644 | Analyzed | 未確認 | CWE-22 | esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerabili |
| CVE-2026-23645 | Analyzed | 未確認 | CWE-79 | SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The applica |
| CVE-2026-23646 | Analyzed | 未確認 | CWE-488 | OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active session |
| CVE-2026-23683 | Deferred | 未確認 | CWE-862 | SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low imp |
| CVE-2026-23699 | Deferred | 未確認 | CWE-78 | AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be execu |
| CVE-2026-23709 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23710 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23711 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23712 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23713 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23714 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23721 | Analyzed | 未確認 | CWE-862 | OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have |
| CVE-2026-23722 | Analyzed | 未確認 | CWE-79 | WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the |
| CVE-2026-23723 | Analyzed | 未確認 | CWE-89 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the |
| CVE-2026-23724 | Analyzed | 未確認 | CWE-79 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/atendido/cadastro_ocorrencia.php en |
| CVE-2026-23725 | Analyzed | 未確認 | CWE-79 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/cadastro_adotante.php |
| CVE-2026-23726 | Analyzed | 未確認 | CWE-601 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, An Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA applicati |
| CVE-2026-23727 | Analyzed | 未確認 | CWE-601 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA applicati |
| CVE-2026-23728 | Analyzed | 未確認 | CWE-601 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA applicati |
| CVE-2026-23729 | Analyzed | 未確認 | CWE-601 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA applicati |
| CVE-2026-23730 | Analyzed | 未確認 | CWE-601 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA applicati |
| CVE-2026-23731 | Analyzed | 未確認 | CWE-1021 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTT |
| CVE-2026-23732 | Analyzed | 未確認 | CWE-122 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum |
| CVE-2026-23733 | Deferred | 未確認 | CWE-94 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows att |
| CVE-2026-23735 | Deferred | 未確認 | CWE-362 | GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to befor |
| CVE-2026-23736 | Analyzed | 未確認 | CWE-1321 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a mali |
| CVE-2026-23737 | Analyzed | 未確認 | CWE-502 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON dese |
| CVE-2026-23742 | Analyzed | 未確認 | CWE-250, CWE-522, CWE-94 | Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted u |
| CVE-2026-23743 | Analyzed | 未確認 | CWE-200 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, permalinks pointing to access-restricted resources (private topics, |
| CVE-2026-23744 | Analyzed | 未確認 | CWE-306 | MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an at |
| CVE-2026-23745 | Modified | 未確認 | CWE-22 | node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default s |
| CVE-2026-23746 | Deferred | 未確認 | CWE-306, CWE-502 | Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoti |
| CVE-2026-23754 | Analyzed | 未確認 | CWE-639 | D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value |
| CVE-2026-23755 | Analyzed | 未確認 | CWE-427 | D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attem |
| CVE-2026-23760 | Analyzed | 掲載 | CWE-288 | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous |
| CVE-2026-23761 | Deferred | 未確認 | CWE-824 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix |
| CVE-2026-23762 | Deferred | 未確認 | CWE-755 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix |
| CVE-2026-23763 | Deferred | 未確認 | CWE-668 | VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a local privilege escalation vulnerability in the VBMatrix VAIO virtu |
| CVE-2026-23764 | Deferred | 未確認 | CWE-823 | VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix |
| CVE-2026-23766 | Rejected | 未確認 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. | |
| CVE-2026-23768 | Analyzed | 未確認 | CWE-918 | lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is en |
| CVE-2026-23769 | Analyzed | 未確認 | CWE-79 | lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files. |
| CVE-2026-23800 | Deferred | 未確認 | CWE-266 | Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from 2.5.2 before 2.6.0. |
| CVE-2026-23829 | Analyzed | 未確認 | CWE-150, CWE-93 | Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression |
| CVE-2026-23830 | Analyzed | 未確認 | CWE-693, CWE-913, CWE-94 | SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The libra |
| CVE-2026-23831 | Analyzed | 未確認 | CWE-476 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry |
| CVE-2026-23833 | Analyzed | 未確認 | CWE-190 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobu |
| CVE-2026-23835 | Deferred | 未確認 | CWE-73 | LobeHub is an open source human-and-AI-agent network. Prior to version 1.143.3, the file upload feature in `Knowledge Base > File Upload` does not validate the integrity of the upl |
| CVE-2026-23836 | Analyzed | 未確認 | CWE-20 | HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to tri |
| CVE-2026-23837 | Analyzed | 未確認 | CWE-863 | MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to |
| CVE-2026-23838 | Deferred | 未確認 | CWE-538 | Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration o |
| CVE-2026-23839 | Analyzed | 未確認 | CWE-20, CWE-79 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versio |
| CVE-2026-23840 | Analyzed | 未確認 | CWE-20, CWE-79 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versio |
| CVE-2026-23841 | Analyzed | 未確認 | CWE-20, CWE-79 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versio |
| CVE-2026-23842 | Analyzed | 未確認 | CWE-400 | ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by im |
| CVE-2026-23843 | Deferred | 未確認 | CWE-639 | teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401b6224eead4fb183ea1c, |
| CVE-2026-23844 | Analyzed | 未確認 | CWE-488, CWE-639 | Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other |
| CVE-2026-23845 | Analyzed | 未確認 | CWE-918 | Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check f |
| CVE-2026-23846 | Analyzed | 未確認 | CWE-598 | Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query par |
| CVE-2026-23847 | Analyzed | 未確認 | CWE-79 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. |
| CVE-2026-23848 | Analyzed | 未確認 | CWE-807 | MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing allows unauthenticat |
| CVE-2026-23849 | Analyzed | 未確認 | CWE-203, CWE-208 | File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to version 2.55.0, the JSONAu |
| CVE-2026-23850 | Analyzed | 未確認 | CWE-22 | SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read ( |
| CVE-2026-23851 | Analyzed | 未確認 | CWE-22 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated |
| CVE-2026-23852 | Analyzed | 未確認 | CWE-79, CWE-94 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject arbitrary HTML at |
| CVE-2026-23864 | Modified | 未確認 | CWE-1284, CWE-400, CWE-502 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom |
| CVE-2026-23873 | Analyzed | 未確認 | CWE-1236 | hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the cont |
| CVE-2026-23874 | Analyzed | 未確認 | CWE-835 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a stack overflow via infinite recursion in MSL (Magic |
| CVE-2026-23875 | Analyzed | 未確認 | CWE-862 | CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing permission check for the |
| CVE-2026-23876 | Modified | 未確認 | CWE-122, CWE-190, CWE-787 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the |
| CVE-2026-23877 | Analyzed | 未確認 | CWE-25, CWE-284 | Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable |
| CVE-2026-23878 | Analyzed | 未確認 | CWE-201 | HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at leas |
| CVE-2026-23880 | Deferred | 未確認 | CWE-116, CWE-20, CWE-79 | OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a |
| CVE-2026-23881 | Analyzed | 未確認 | CWE-770 | Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine th |
| CVE-2026-23883 | Modified | 未確認 | CWE-416 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Fr |
| CVE-2026-23884 | Modified | 未確認 | CWE-416 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when |
| CVE-2026-23885 | Analyzed | 未確認 | CWE-95 | Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamica |
| CVE-2026-23886 | Deferred | 未確認 | CWE-20 | Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, Swift Metrics, and Swi |
| CVE-2026-23887 | Analyzed | 未確認 | CWE-20, CWE-79 | Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized fil |
| CVE-2026-23888 | Analyzed | 未確認 | CWE-22, CWE-23, CWE-426 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extractio |
| CVE-2026-23889 | Analyzed | 未確認 | CWE-22 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package direct |
| CVE-2026-23890 | Analyzed | 未確認 | CWE-23 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outsi |
| CVE-2026-23892 | Analyzed | 未確認 | CWE-208 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability t |
| CVE-2026-23893 | Analyzed | 未確認 | CWE-59 | openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token- |
| CVE-2026-23896 | Analyzed | 未確認 | CWE-269 | immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, al |
| CVE-2026-23909 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23910 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23911 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23912 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23913 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23914 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23915 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23916 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23917 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-23944 | Analyzed | 未確認 | CWE-306 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agent |
| CVE-2026-23946 | Analyzed | 未確認 | CWE-502, CWE-94 | Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulner |
| CVE-2026-23947 | Analyzed | 未確認 | CWE-77, CWE-94 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execu |
| CVE-2026-23949 | Analyzed | 未確認 | CWE-22 | jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarbal |
| CVE-2026-23950 | Modified | 未確認 | CWE-176, CWE-352, CWE-367 | node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path- |
| CVE-2026-23951 | Analyzed | 未確認 | CWE-125, CWE-191, CWE-193 | SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer under |
| CVE-2026-23952 | Analyzed | 未確認 | CWE-476 | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL ( |
| CVE-2026-23953 | Analyzed | 未確認 | CWE-93 | Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member |
| CVE-2026-23954 | Analyzed | 未確認 | CWE-22 | Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the ‘inc |
| CVE-2026-23955 | Analyzed | 未確認 | CWE-1046 | EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in poi |
| CVE-2026-23956 | Modified | 未確認 | CWE-1333 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with |
| CVE-2026-23957 | Analyzed | 未確認 | CWE-770 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by repl |
| CVE-2026-23958 | Analyzed | 未確認 | CWE-522 | Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This determinist |
| CVE-2026-23959 | Analyzed | 未確認 | CWE-564 | CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` withi |
| CVE-2026-23960 | Modified | 未確認 | CWE-79 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact dire |
| CVE-2026-23961 | Analyzed | 未確認 | CWE-863 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some log |
| CVE-2026-23962 | Analyzed | 未確認 | CWE-770 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the maximum number of poll |
| CVE-2026-23963 | Analyzed | 未確認 | CWE-770 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names |
| CVE-2026-23964 | Analyzed | 未確認 | CWE-639, CWE-863 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in the web push subscri |
| CVE-2026-23965 | Analyzed | 未確認 | CWE-347 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature forgery vulnerability exists in the SM2 signature verification |
| CVE-2026-23966 | Analyzed | 未確認 | CWE-345 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of |
| CVE-2026-23967 | Analyzed | 未確認 | CWE-347 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verifica |
| CVE-2026-23968 | Analyzed | 未確認 | CWE-61 | Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that d |
| CVE-2026-23974 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5. |
| CVE-2026-23975 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo golo allows PHP Local File Inclusion.This issue |
| CVE-2026-23976 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Stored XSS.This |
| CVE-2026-23978 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Softwebmedia Gyan Elements gyan-elements allows PHP Local F |
| CVE-2026-23986 | Analyzed | 未確認 | CWE-61 | Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that d |
| CVE-2026-23988 | Analyzed | 未確認 | CWE-367 | Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the creation, validation, a |
| CVE-2026-23990 | Analyzed | 未確認 | CWE-269, CWE-862 | The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to ve |
| CVE-2026-23991 | Analyzed | 未確認 | CWE-617, CWE-754 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF |
| CVE-2026-23992 | Analyzed | 未確認 | CWE-347 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the config |
| CVE-2026-23996 | Analyzed | 未確認 | CWE-208 | FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a ran |
| CVE-2026-24001 | Modified | 未確認 | CWE-1333, CWE-400 | jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break |
| CVE-2026-24002 | Analyzed | 未確認 | CWE-74 | Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working wi |
| CVE-2026-24003 | Analyzed | 未確認 | CWE-287, CWE-863 | EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authentication, and send req |
| CVE-2026-24006 | Analyzed | 未確認 | CWE-770 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme de |
| CVE-2026-24009 | Analyzed | 未確認 | CWE-502 | Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution |
| CVE-2026-24010 | Analyzed | 未確認 | CWE-434, CWE-474, CWE-74 | Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenti |
| CVE-2026-24016 | Deferred | 未確認 | CWE-427 | The installer of ServerView Agents for Windows provided by Fsas Technologies Inc. may insecurely load Dynamic Link Libraries. Arbitrary code may be executed with the administrator |
| CVE-2026-24020 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24021 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24022 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24023 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24024 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24025 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24026 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24034 | Analyzed | 未確認 | CWE-434 | Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension a |
| CVE-2026-24035 | Analyzed | 未確認 | CWE-284 | Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prio |
| CVE-2026-24036 | Analyzed | 未確認 | CWE-284 | Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// e |
| CVE-2026-24037 | Analyzed | 未確認 | CWE-79 | Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex p |
| CVE-2026-24038 | Analyzed | 未確認 | CWE-287 | Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP ex |
| CVE-2026-24039 | Analyzed | 未確認 | CWE-284 | Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self-approve documents th |
| CVE-2026-24042 | Analyzed | 未確認 | CWE-862 | Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublishe |
| CVE-2026-24046 | Deferred | 未確認 | CWE-22, CWE-59 | Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. |
| CVE-2026-24047 | Deferred | 未確認 | CWE-59, CWE-61 | Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Bac |
| CVE-2026-24048 | Analyzed | 未確認 | CWE-918 | Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. |
| CVE-2026-24049 | Modified | 未確認 | CWE-22, CWE-732 | wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission mod |
| CVE-2026-24054 | Analyzed | 未確認 | CWE-754 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, whe |
| CVE-2026-24055 | Analyzed | 未確認 | CWE-284, CWE-862 | Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId |
| CVE-2026-24056 | Analyzed | 未確認 | CWE-22, CWE-59 | pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a `file:` (directory) or `git:` dependency, it follows symlinks and reads their target contents without cons |
| CVE-2026-24058 | Analyzed | 未確認 | CWE-289 | Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate |
| CVE-2026-24061 | Analyzed | 掲載 | CWE-88 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
| CVE-2026-24116 | Analyzed | 未確認 | CWE-125 | Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64. |
| CVE-2026-24117 | Analyzed | 未確認 | CWE-918 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports re |
| CVE-2026-24123 | Analyzed | 未確認 | CWE-22 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows |
| CVE-2026-24124 | Analyzed | 未確認 | CWE-306 | Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authenticatio |
| CVE-2026-24127 | Analyzed | 未確認 | CWE-116, CWE-79 | Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login |
| CVE-2026-24128 | Analyzed | 未確認 | CWE-79, CWE-80 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and |
| CVE-2026-24129 | Analyzed | 未確認 | CWE-78 | Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute a |
| CVE-2026-24130 | Analyzed | 未確認 | CWE-209, CWE-90 | Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulne |
| CVE-2026-24131 | Analyzed | 未確認 | CWE-22, CWE-732 | pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the p |
| CVE-2026-24132 | Analyzed | 未確認 | CWE-77, CWE-94 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted Ope |
| CVE-2026-24134 | Analyzed | 未確認 | CWE-639, CWE-862 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in t |
| CVE-2026-24136 | Analyzed | 未確認 | CWE-639 | Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulner |
| CVE-2026-24137 | Deferred | 未確認 | CWE-22 | sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching targ |
| CVE-2026-24138 | Deferred | 未確認 | CWE-918 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php w |
| CVE-2026-24139 | Analyzed | 未確認 | CWE-862 | MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download |
| CVE-2026-24140 | Analyzed | 未確認 | CWE-915 | MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality du |
| CVE-2026-24304 | Modified | 未確認 | CWE-284 | Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-24305 | Analyzed | 未確認 | CWE-285 | Azure Entra ID Elevation of Privilege Vulnerability |
| CVE-2026-24306 | Analyzed | 未確認 | CWE-284 | Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-24307 | Analyzed | 未確認 | CWE-1287 | Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-24332 | Deferred | 未確認 | CWE-204 | Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request |
| CVE-2026-24334 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24335 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24336 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24337 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24338 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24339 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24340 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24341 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24342 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24344 | Deferred | 未確認 | CWE-120 | Multiple Buffer Overflows in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to cause a program crash and potential remote code execution |
| CVE-2026-24345 | Analyzed | 未確認 | CWE-20, CWE-352 | Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full access to the admin UI |
| CVE-2026-24346 | Analyzed | 未確認 | CWE-798 | Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the web application |
| CVE-2026-24347 | Analyzed | 未確認 | CWE-20 | Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directory |
| CVE-2026-24348 | Analyzed | 未確認 | CWE-20, CWE-79 | Multiple cross-site scripting vulnerabilities in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to execute arbitrary JavaScript code in the browser of other Admin UI |
| CVE-2026-24353 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User |
| CVE-2026-24354 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcodes allows DOM-Based X |
| CVE-2026-24355 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stor |
| CVE-2026-24356 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetGenie: from n/a throug |
| CVE-2026-24357 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Recipe M |
| CVE-2026-24358 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issu |
| CVE-2026-24360 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Server Side Request Forgery.This issue affects Serio |
| CVE-2026-24361 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-review allows Stored XS |
| CVE-2026-24365 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This issue affects Stock Mana |
| CVE-2026-24366 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security L |
| CVE-2026-24367 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Tra |
| CVE-2026-24368 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8 |
| CVE-2026-24371 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af |
| CVE-2026-24374 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue |
| CVE-2026-24377 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensiti |
| CVE-2026-24379 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.Th |
| CVE-2026-24380 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2026-24381 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through < 5.7.2. |
| CVE-2026-24383 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issue affects B Slider: f |
| CVE-2026-24384 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allows Cross Site Request Forgery.This issue affects Merge + Mini |
| CVE-2026-24386 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allows Exploiting Incorrectly Configured Access Control Security |
| CVE-2026-24387 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This |
| CVE-2026-24388 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMaste |
| CVE-2026-24389 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows DOM-Based XSS.Thi |
| CVE-2026-24390 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Kentha Elementor Widgets kentha-elementor allo |
| CVE-2026-24398 | Analyzed | 未確認 | CWE-185 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address vali |
| CVE-2026-24399 | Analyzed | 未確認 | CWE-79 | ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. S |
| CVE-2026-24400 | Analyzed | 未確認 | CWE-611 | AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerab |
| CVE-2026-24401 | Modified | 未確認 | CWE-674 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segment |
| CVE-2026-24402 | Rejected | 未確認 | Rejected reason: GitHub cannot issue a CVE for this Security Advisory because this advisory includes information about more than one vulnerability. According to [rule 4.2.11 of | |
| CVE-2026-24403 | Analyzed | 未確認 | CWE-190, CWE-20 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer overflow vulnerability |
| CVE-2026-24404 | Analyzed | 未確認 | CWE-20, CWE-476, CWE-690, CWE-758 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Nul |
| CVE-2026-24405 | Analyzed | 未確認 | CWE-122, CWE-20 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerabi |
| CVE-2026-24406 | Analyzed | 未確認 | CWE-122, CWE-20 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerabi |
| CVE-2026-24407 | Analyzed | 未確認 | CWE-20, CWE-758 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in icSigCalcO |
| CVE-2026-24408 | Analyzed | 未確認 | CWE-352 | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Sit |
| CVE-2026-24409 | Analyzed | 未確認 | CWE-20, CWE-476, CWE-690, CWE-758 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Poin |
| CVE-2026-24410 | Analyzed | 未確認 | CWE-20, CWE-476, CWE-690, CWE-758 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Poin |
| CVE-2026-24411 | Analyzed | 未確認 | CWE-20, CWE-476, CWE-690, CWE-758 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in CIccTagXml |
| CVE-2026-24412 | Analyzed | 未確認 | CWE-122, CWE-20 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerabil |
| CVE-2026-24413 | Analyzed | 未確認 | CWE-276 | Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for |
| CVE-2026-24414 | Analyzed | 未確認 | CWE-276 | The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments. In versions prior to 1.13.4, 1.12.4, an |
| CVE-2026-24420 | Analyzed | 未確認 | CWE-284 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incom |
| CVE-2026-24421 | Analyzed | 未確認 | CWE-862 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user des |
| CVE-2026-24422 | Analyzed | 未確認 | CWE-200 | phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access |
| CVE-2026-24423 | Analyzed | 掲載 | CWE-306 | SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the Sm |
| CVE-2026-24428 | Analyzed | 未確認 | CWE-863 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated u |
| CVE-2026-24429 | Analyzed | 未確認 | CWE-1393 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to |
| CVE-2026-24430 | Analyzed | 未確認 | CWE-201 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenanc |
| CVE-2026-24431 | Analyzed | 未確認 | CWE-317 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface. Any user |
| CVE-2026-24432 | Analyzed | 未確認 | CWE-352 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints, including those used |
| CVE-2026-24433 | Analyzed | 未確認 | CWE-79 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient |
| CVE-2026-24435 | Analyzed | 未確認 | CWE-942 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative end |
| CVE-2026-24436 | Analyzed | 未確認 | CWE-307 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows a |
| CVE-2026-24437 | Analyzed | 未確認 | CWE-525 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directives. As a result, bro |
| CVE-2026-24439 | Analyzed | 未確認 | CWE-116 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As |
| CVE-2026-24440 | Analyzed | 未確認 | CWE-620 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verificatio |
| CVE-2026-24469 | Deferred | 未確認 | CWE-22 | C++ HTTP Server is an HTTP/1.1 server built to handle client connections and serve HTTP requests. Versions 1.0 and below are vulnerable to Path Traversal via the RequestHandler::ha |
| CVE-2026-24470 | Analyzed | 未確認 | CWE-441, CWE-918 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ing |
| CVE-2026-24472 | Analyzed | 未確認 | CWE-524, CWE-613 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability cau |
| CVE-2026-24473 | Analyzed | 未確認 | CWE-200, CWE-284, CWE-668 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains a |
| CVE-2026-24474 | Deferred | 未確認 | CWE-94, CWE-95 | Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, `use_animated_open` formats a string f |
| CVE-2026-24476 | Analyzed | 未確認 | CWE-79 | Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with `"` prematurely ends the `<input>` tag on the start page and allows |
| CVE-2026-24477 | Analyzed | 未確認 | CWE-201 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to |
| CVE-2026-24478 | Analyzed | 未確認 | CWE-22 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulne |
| CVE-2026-24479 | Analyzed | 未確認 | CWE-22 | HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.ph |
| CVE-2026-24480 | Deferred | 未確認 | CWE-863 | QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 7 |
| CVE-2026-24486 | Modified | 未確認 | CWE-22 | Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR |
| CVE-2026-24489 | Deferred | 未確認 | CWE-113, CWE-93 | Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injec |
| CVE-2026-24490 | Analyzed | 未確認 | CWE-79 | MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an a |
| CVE-2026-24515 | Modified | 未確認 | CWE-476 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. |
| CVE-2026-24521 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Timur Kamaev Kama Thumbnail kama-thumbnail allows Cross Site Request Forgery.This issue affects Kama Thumbnail: from n/a through |
| CVE-2026-24522 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscribe |
| CVE-2026-24523 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive |
| CVE-2026-24524 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a th |
| CVE-2026-24525 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CLP |
| CVE-2026-24526 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce woocommerce-email-in |
| CVE-2026-24528 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nov |
| CVE-2026-24529 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels |
| CVE-2026-24530 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebP Con |
| CVE-2026-24531 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusi |
| CVE-2026-24532 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Se |
| CVE-2026-24534 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in uPress Booter booter-bots-crawlers-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booter: |
| CVE-2026-24535 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Con |
| CVE-2026-24536 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Dat |
| CVE-2026-24538 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inc |
| CVE-2026-24539 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2026-24540 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2026-24541 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect |
| CVE-2026-24542 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term Order: from n/a throug |
| CVE-2026-24543 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec |
| CVE-2026-24544 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz: from n/a |
| CVE-2026-24548 | Deferred | 未確認 | CWE-918 | Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2. |
| CVE-2026-24549 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a through <= 2.8.149. |
| CVE-2026-24550 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaira Blockons blockons allows Stored XSS.This issue affects Blockons: from n/ |
| CVE-2026-24551 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2026-24553 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-black |
| CVE-2026-24555 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored XSS.This issue affec |
| CVE-2026-24556 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from |
| CVE-2026-24557 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in WEN Solutions Contact Form 7 GetResponse Extension contact-form-7-getresponse-extension allows Retrieve Embedded |
| CVE-2026-24558 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antoniobg ABG Rich Pins abg-rich-pins allows Stored XSS.This issue affects ABG |
| CVE-2026-24559 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Retrieve Embedded Sensitive Data.This issue a |
| CVE-2026-24560 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Configured Access Control S |
| CVE-2026-24561 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flu |
| CVE-2026-24562 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect |
| CVE-2026-24563 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LifePress: from n |
| CVE-2026-24564 | Deferred | 未確認 | CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Israpil Textmetrics webtexttool allows Code Injection.This issue affects Textmetrics: |
| CVE-2026-24565 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects B Accordion: from n/a |
| CVE-2026-24566 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iNET Webkit: from n/a |
| CVE-2026-24567 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a |
| CVE-2026-24568 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a |
| CVE-2026-24569 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Sully Media Library File Size media-library-file-size allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe |
| CVE-2026-24570 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Edwiser Br |
| CVE-2026-24571 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in boxnow BOX NOW Delivery box-now-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BOX NOW D |
| CVE-2026-24572 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This iss |
| CVE-2026-24576 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in COP UX Flat ux-flat allows Stored XSS.This issue affects UX Flat: from n/a thr |
| CVE-2026-24577 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Re |
| CVE-2026-24578 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Security Levels.This issue |
| CVE-2026-24579 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Secu |
| CVE-2026-24580 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control S |
| CVE-2026-24581 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Secur |
| CVE-2026-24583 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Sec |
| CVE-2026-24584 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS BunnyNet Integration tutor-lms-bunnynet-integration allows D |
| CVE-2026-24585 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Access Control Security |
| CVE-2026-24587 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control Security Levels.This |
| CVE-2026-24588 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2026-24589 | Deferred | 未確認 | CWE-201 | Insertion of Sensitive Information Into Sent Data vulnerability in Cargus eCommerce Cargus cargus allows Retrieve Embedded Sensitive Data.This issue affects Cargus: from n/a throug |
| CVE-2026-24591 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yasir129 Turn Yoast SEO FAQ Block to Accordion faq-schema-block-to-accordion a |
| CVE-2026-24593 | Deferred | 未確認 | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Emb |
| CVE-2026-24594 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer |
| CVE-2026-24595 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho C |
| CVE-2026-24596 | Deferred | 未確認 | CWE-352 | Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.This issue aff |
| CVE-2026-24598 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff |
| CVE-2026-24599 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control S |
| CVE-2026-24600 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Review penci-review allows Stored XSS.This issue affects Pen |
| CVE-2026-24601 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stored XSS.This issue aff |
| CVE-2026-24602 | Rejected | 未確認 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This is a false positive. According to the vendor, the function identified as a vulnerab | |
| CVE-2026-24603 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectly Configured Access C |
| CVE-2026-24604 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Control Security Levels |
| CVE-2026-24605 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects |
| CVE-2026-24606 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Baya |
| CVE-2026-24607 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trave |
| CVE-2026-24608 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent Core laurent-core allows PHP Local Fi |
| CVE-2026-24609 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusi |
| CVE-2026-24612 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orchid Store: |
| CVE-2026-24613 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control S |
| CVE-2026-24614 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Devsbrain Flex QR Code Generator flex-qr-code-generator allows DOM-Based XSS.T |
| CVE-2026-24615 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in themebeez Cream Magazine cream-magazine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Maga |
| CVE-2026-24616 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Damian WP Popups wp-popups-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Popups: from n/ |
| CVE-2026-24617 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Easy Modal easy-modal allows Stored XSS.This issue affects Easy Mo |
| CVE-2026-24619 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Access Control Security L |
| CVE-2026-24620 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder page-builder-add allows Stored XSS.This issue a |
| CVE-2026-24621 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows DOM-Based XSS. |
| CVE-2026-24622 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec |
| CVE-2026-24623 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saeros1984 Neoforum neoforum allows Reflected XSS.This issue affects Neoforum: |
| CVE-2026-24624 | Deferred | 未確認 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.This issue affects Neo |
| CVE-2026-24625 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Lev |
| CVE-2026-24626 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Logo Slider logo-slider-wp allows Stored XSS.This issue affects Logo |
| CVE-2026-24627 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Trusona Trusona for WordPress trusona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusona for |
| CVE-2026-24629 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows St |
| CVE-2026-24630 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This |
| CVE-2026-24631 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a |
| CVE-2026-24632 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jagdish1o1 Delay Redirects delay-redirects allows DOM-Based XSS.This issue aff |
| CVE-2026-24633 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security |
| CVE-2026-24634 | Deferred | 未確認 | CWE-639 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Leve |
| CVE-2026-24635 | Deferred | 未確認 | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DevsBlink EduBlink Core edublink-core allows PHP Local File |
| CVE-2026-24636 | Deferred | 未確認 | CWE-862 | Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe |
| CVE-2026-24642 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24643 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24644 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24645 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24646 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24647 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24648 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24649 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24656 | Analyzed | 未確認 | CWE-502 | Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector expose |
| CVE-2026-24685 | Analyzed | 未確認 | CWE-77 | OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository dif |
| CVE-2026-24686 | Analyzed | 未確認 | CWE-22 | go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component wh |
| CVE-2026-24687 | Analyzed | 未確認 | CWE-22 | Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files |
| CVE-2026-24688 | Analyzed | 未確認 | CWE-835 | pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads |
| CVE-2026-24714 | Deferred | 未確認 | CWE-1242 | Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box. |
| CVE-2026-24728 | Deferred | 未確認 | CWE-306 | A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to access |
| CVE-2026-24729 | Deferred | 未確認 | CWE-434 | An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to execute a |
| CVE-2026-24736 | Analyzed | 未確認 | CWE-918 | Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as |
| CVE-2026-24738 | Analyzed | 未確認 | CWE-400, CWE-770 | gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths that can range up to 4GB, which can cause u |
| CVE-2026-24739 | Analyzed | 未確認 | CWE-88 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, the Symfony Process co |
| CVE-2026-24740 | Analyzed | 未確認 | CWE-284, CWE-863 | Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for exampl |
| CVE-2026-24741 | Analyzed | 未確認 | CWE-22 | ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and |
| CVE-2026-24742 | Analyzed | 未確認 | CWE-863 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action |
| CVE-2026-24747 | Modified | 未確認 | CWE-502, CWE-94 | PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious |
| CVE-2026-24748 | Analyzed | 未確認 | CWE-863 | Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endp |
| CVE-2026-24765 | Analyzed | 未確認 | CWE-502 | PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of co |
| CVE-2026-24766 | Analyzed | 未確認 | CWE-1321 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the |
| CVE-2026-24767 | Analyzed | 未確認 | CWE-918 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functiona |
| CVE-2026-24768 | Analyzed | 未確認 | CWE-601 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB’s login flow due to miss |
| CVE-2026-24769 | Analyzed | 未確認 | CWE-434, CWE-79 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechan |
| CVE-2026-24770 | Analyzed | 未確認 | CWE-22 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allow |
| CVE-2026-24771 | Analyzed | 未確認 | CWE-79 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBounda |
| CVE-2026-24772 | Analyzed | 未確認 | CWE-345 | OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The |
| CVE-2026-24775 | Analyzed | 未確認 | CWE-345 | OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, OpenProject maintainers added a custom exten |
| CVE-2026-24778 | Analyzed | 未確認 | CWE-79 | Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when acce |
| CVE-2026-24779 | Modified | 未確認 | CWE-918 | vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` |
| CVE-2026-24780 | Analyzed | 未確認 | CWE-276, CWE-863, CWE-94 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6 |
| CVE-2026-24783 | Analyzed | 未確認 | CWE-682 | soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both |
| CVE-2026-24784 | Analyzed | 未確認 | CWE-79 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a |
| CVE-2026-24785 | Analyzed | 未確認 | CWE-327 | Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Versiosn prior to2.2.0 have a protocol compliance vulnerability. |
| CVE-2026-24793 | Analyzed | 未確認 | CWE-120, CWE-787 | Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability i |
| CVE-2026-24794 | Deferred | 未確認 | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard (src/main/java/org/cardboardpowered/impl/world modules). This vu |
| CVE-2026-24795 | Deferred | 未確認 | CWE-787 | Out-of-bounds Write vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with progra |
| CVE-2026-24796 | Deferred | 未確認 | CWE-125 | Out-of-bounds Read vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program |
| CVE-2026-24797 | Deferred | 未確認 | CWE-787 | Out-of-bounds Write vulnerability in neka-nat cupoch (third_party/libjpeg-turbo/libjpeg-turbo modules). This vulnerability is associated with program files tjbench.C. This issue a |
| CVE-2026-24798 | Deferred | 未確認 | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules). This vulnerability i |
| CVE-2026-24799 | Deferred | 未確認 | CWE-120, CWE-787 | Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is asso |
| CVE-2026-24800 | Deferred | 未確認 | CWE-120, CWE-787 | Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associa |
| CVE-2026-24801 | Deferred | 未確認 | CWE-22 | Vulnerability in Ralim IronOS (source/Core/BSP/Pinecilv2/bl_mcu_sdk/components/ble/ble_stack/common/tinycrypt/source modules). This vulnerability is associated with program files e |
| CVE-2026-24802 | Deferred | 未確認 | CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated wit |
| CVE-2026-24803 | Deferred | 未確認 | CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modules). This vulnerabilit |
| CVE-2026-24804 | Deferred | 未確認 | CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules). This vulnerability is as |
| CVE-2026-24805 | Deferred | 未確認 | CWE-476 | NULL Pointer Dereference vulnerability in visualfc liteide (liteidex/src/3rdparty/libvterm/src modules). This vulnerability is associated with program files screen.C, state.C, vter |
| CVE-2026-24806 | Deferred | 未確認 | CWE-94 | Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/cod |
| CVE-2026-24807 | Deferred | 未確認 | CWE-347 | Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util m |
| CVE-2026-24808 | Deferred | 未確認 | CWE-190 | Integer Overflow or Wraparound vulnerability in RawTherapee (rtengine modules). This vulnerability is associated with program files dcraw.Cc. This issue affects RawTherapee: throu |
| CVE-2026-24809 | Deferred | 未確認 | CWE-787 | An issue from the component luaG_runerror in dependencies/lua/src/ldebug.c in praydog/REFramework version before 1.5.5 leads to a heap-buffer overflow when a recursive error occurs |
| CVE-2026-24810 | Deferred | 未確認 | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules). This vulnerability is associated with program files cJSON.Cc. |
| CVE-2026-24811 | Modified | 未確認 | CWE-119, CWE-125, CWE-20, CWE-787 | Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inffast.C. This issue affects root. |
| CVE-2026-24812 | Deferred | 未確認 | CWE-125 | Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inftrees.C. This issue affects root: through 6.36.00-rc1. |
| CVE-2026-24813 | Deferred | 未確認 | CWE-476 | NULL Pointer Dereference vulnerability in abcz316 SKRoot-linuxKernelRoot (testRoot/jni/utils modules). This vulnerability is associated with program files cJSON.Cpp. This issue af |
| CVE-2026-24814 | Deferred | 未確認 | CWE-190 | Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is associated with program files sds.C. This issue affects swool |
| CVE-2026-24815 | Deferred | 未確認 | CWE-434, CWE-502 | Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extension/impl modules) |
| CVE-2026-24816 | Deferred | 未確認 | CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis (tis-console/src/main/java/com/qlangtech/tis/runtime/module/action modules). This vulnerability |
| CVE-2026-24817 | Deferred | 未確認 | CWE-787 | Out-of-bounds Write vulnerability in praydog UEVR (dependencies/lua/src modules). This vulnerability is associated with program files ldebug.C, lvm.C. This issue affects UEVR: bef |
| CVE-2026-24818 | Deferred | 未確認 | CWE-125 | Out-of-bounds Read vulnerability in praydog UEVR (dependencies/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects UEVR: before 1.0 |
| CVE-2026-24819 | Deferred | 未確認 | CWE-1325 | Improperly Controlled Sequential Memory Allocation vulnerability in foxinmy weixin4j (weixin4j-base/src/main/java/com/foxinmy/weixin4j/util modules). This vulnerability is associat |
| CVE-2026-24820 | Deferred | 未確認 | CWE-125 | Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files ldebug.C. This issue affects WickedEngi |
| CVE-2026-24821 | Deferred | 未確認 | CWE-125 | Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C. This issue affects WickedEng |
| CVE-2026-24822 | Deferred | 未確認 | CWE-122, CWE-787 | Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is associated with program files mongoose.C. This issue affect |
| CVE-2026-24823 | Deferred | 未確認 | CWE-120, CWE-787 | Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT X-TRACK (Software/X-Track/USER/App/Utils/lv_img_png/PNGdec/sr |
| CVE-2026-24824 | Deferred | 未確認 | CWE-79 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in yacy yacy_search_server (source/net/yacy/http/servlets modules). This v |
| CVE-2026-24825 | Deferred | 未確認 | CWE-401 | Missing Release of Memory after Effective Lifetime vulnerability in ydb-platform ydb (contrib/libs/yajl modules). This vulnerability is associated with program files yail_tree.C. |
| CVE-2026-24826 | Deferred | 未確認 | CWE-125, CWE-369, CWE-476, CWE-617, CWE-787, CWE-908 | Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion vulnerability in cadaver turso3d.This issue af |
| CVE-2026-24827 | Deferred | 未確認 | CWE-787 | Out-of-bounds Write vulnerability in gerstrong Commander-Genius.This issue affects Commander-Genius: before Release refs/pull/358/merge. |
| CVE-2026-24828 | Deferred | 未確認 | CWE-401 | Missing Release of Memory after Effective Lifetime vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4. |
| CVE-2026-24829 | Deferred | 未確認 | CWE-122, CWE-787 | Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4. |
| CVE-2026-24830 | Deferred | 未確認 | CWE-190 | Integer Overflow or Wraparound vulnerability in Ralim IronOS.This issue affects IronOS: before v2.23-rc2. |
| CVE-2026-24831 | Analyzed | 未確認 | CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3. |
| CVE-2026-24832 | Analyzed | 未確認 | CWE-787 | Out-of-bounds Write vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3. |
| CVE-2026-24833 | Analyzed | 未確認 | CWE-79 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with rich |
| CVE-2026-24835 | Analyzed | 未確認 | CWE-285 | Podman Desktop is a graphical tool for developing on containers and Kubernetes. A critical authentication bypass vulnerability in Podman Desktop prior to version 1.25.1 allows any |
| CVE-2026-24836 | Analyzed | 未確認 | CWE-79 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, ex |
| CVE-2026-24837 | Analyzed | 未確認 | CWE-79 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a |
| CVE-2026-24838 | Analyzed | 未確認 | CWE-79 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext |
| CVE-2026-24839 | Analyzed | 未確認 | CWE-1021 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-bus |
| CVE-2026-24840 | Analyzed | 未確認 | CWE-798 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.c |
| CVE-2026-24841 | Analyzed | 未確認 | CWE-78 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/dock |
| CVE-2026-24842 | Modified | 未確認 | CWE-22, CWE-59 | node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actu |
| CVE-2026-24845 | Analyzed | 未確認 | CWE-522 | malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to |
| CVE-2026-24846 | Analyzed | 未確認 | CWE-22, CWE-683 | malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8.0 and prior to version 1.20.3, malcontent could be made to |
| CVE-2026-24850 | Deferred | 未確認 | CWE-347 | The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA sig |
| CVE-2026-24852 | Analyzed | 未確認 | CWE-122, CWE-125, CWE-170 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer |
| CVE-2026-24854 | Analyzed | 未確認 | CWE-89 | ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated |
| CVE-2026-24855 | Analyzed | 未確認 | CWE-79 | ChurchCRM is an open-source church management system. Versions prior to 6.7.2 have a Stored Cross-Site Scripting (XSS) vulnerability occurs in Create Events in Church Calendar. Use |
| CVE-2026-24856 | Analyzed | 未確認 | CWE-20, CWE-681, CWE-704 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undef |
| CVE-2026-24857 | Analyzed | 未確認 | CWE-122, CWE-787 | `bulk_extractor` is a digital forensics exploitation tool. Starting in version 1.4, `bulk_extractor`’s embedded unrar code has a heap‑buffer‑overflow in the RAR PPM LZ decoding pat |
| CVE-2026-24858 | Analyzed | 掲載 | CWE-288 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, |
| CVE-2026-24859 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24860 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24861 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24862 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24863 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24864 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24865 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24866 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24867 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-24868 | Modified | 未確認 | CWE-693 | Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 147.0.2. |
| CVE-2026-24869 | Modified | 未確認 | CWE-416 | Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2. |
| CVE-2026-24870 | Analyzed | 未確認 | CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3. |
| CVE-2026-24871 | Deferred | 未確認 | CWE-94 | Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before 3.0. |
| CVE-2026-24872 | Deferred | 未確認 | CWE-468 | improper pointer arithmetic vulnerability in ProjectSkyfire SkyFire_548.This issue affects SkyFire_548: before 5.4.8-stable5. |
| CVE-2026-24873 | Deferred | 未確認 | CWE-125 | Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita.This issue affects lpp-vita: before lpp-vita r6. |
| CVE-2026-24874 | Analyzed | 未確認 | CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30. |
| CVE-2026-24875 | Deferred | 未確認 | CWE-190 | Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1. |
| CVE-2026-24881 | Modified | 未確認 | CWE-121 | In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT |
| CVE-2026-24882 | Modified | 未確認 | CWE-121 | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. |
| CVE-2026-24883 | Analyzed | 未確認 | CWE-476 | In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application cr |
| CVE-2026-24888 | Analyzed | 未確認 | CWE-1321 | Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function copies properties fro |
| CVE-2026-24889 | Analyzed | 未確認 | CWE-190 | soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban |
| CVE-2026-24897 | Analyzed | 未確認 | CWE-22, CWE-434, CWE-94 | Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due |
| CVE-2026-24902 | Analyzed | 未確認 | CWE-918 | TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In `tcp_forwarder.rs`, SSRF p |
| CVE-2026-24904 | Analyzed | 未確認 | CWE-284 | TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In `tls_listener.rs`, `TlsListener::listen()` peeks 1024 bytes and calls `extract_ |
| CVE-2026-24905 | Modified | 未確認 | CWE-77, CWE-78 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The `ig` binary provides a subcommand |
| CVE-2026-24909 | Deferred | 未確認 | CWE-23 | vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction. |
| CVE-2026-24910 | Deferred | 未確認 | CWE-348 | In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github |
| CVE-2026-25040 | Analyzed | 未確認 | CWE-863 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permi |
| CVE-2026-25046 | Deferred | 未確認 | CWE-77 | Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass filenames to execSync( |
| CVE-2026-25047 | Analyzed | 未確認 | CWE-1321 | deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm pac |
| CVE-2026-25050 | Analyzed | 未確認 | CWE-202 | Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows |
| CVE-2026-25061 | Analyzed | 未確認 | CWE-787 | tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when |
| CVE-2026-25063 | Analyzed | 未確認 | CWE-157, CWE-78 | gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gradle-completion up to and including 9.3.0 that allows arbitr |
| CVE-2026-25067 | Analyzed | 未確認 | CWE-706 | SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64- |
| CVE-2026-25068 | Deferred | 未確認 | CWE-129 | alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_m |
| CVE-2026-25090 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25091 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25092 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25093 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25094 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25095 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25096 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25097 | Rejected | 未確認 | Rejected reason: Not used | |
| CVE-2026-25116 | Analyzed | 未確認 | CWE-22, CWE-306 | Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` a |
| CVE-2026-25117 | Deferred | 未確認 | CWE-20, CWE-79 | pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows c |
| CVE-2026-25126 | Analyzed | 未確認 | CWE-20 | PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value wit |
| CVE-2026-25128 | Analyzed | 未確認 | CWE-20, CWE-248 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a |
| CVE-2026-25129 | Analyzed | 未確認 | CWE-427 | PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `.psysh.php` file from |
| CVE-2026-25130 | Deferred | 未確認 | CWE-78 | Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabili |
| CVE-2026-25141 | Analyzed | 未確認 | CWE-94 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incompl |
| CVE-2026-25152 | Undergoing Analysis | 未確認 | CWE-22 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/p |
| CVE-2026-25153 | Undergoing Analysis | 未確認 | CWE-94 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/p |
| CVE-2026-25154 | Analyzed | 未確認 | CWE-79 | LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions |
| CVE-2026-25156 | Analyzed | 未確認 | CWE-79 | HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Content-Disposition, causing them to be re |
| CVE-2026-25210 | Modified | 未確認 | CWE-190 | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation. |
| CVE-2026-25211 | Deferred | 未確認 | CWE-532 | Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. |