Search
98,287 CVEs
CVEs (98,287, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 376–400 of 98,287 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2023-37749 | MEDIUM | 5.3 | 2025-10-27 | Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization. | |
| CVE-2023-49440 | HIGH | 8.8 | 2025-10-27 | AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." | |
| CVE-2025-10023 | MEDIUM | Patched | 6.2 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services modules) al… |
| CVE-2025-12291 | LOW | 4.7 | 2025-10-27 | A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.php?add_product… | |
| CVE-2025-12292 | MEDIUM | 7.3 | 2025-10-27 | A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the argument Usern… | |
| CVE-2025-12293 | MEDIUM | 7.3 | 2025-10-27 | A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of the argument… | |
| CVE-2025-12294 | LOW | 4.7 | 2025-10-27 | A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipulation of the a… | |
| CVE-2025-34133 | HIGH | — | 2025-10-27 | Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSO… | |
| CVE-2025-60424 | HIGH | 7.6 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack. | |
| CVE-2025-60425 | HIGH | 8.6 | 2025-10-27 | Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perfo… | |
| CVE-2025-60791 | MEDIUM | 6.2 | 2025-10-27 | Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memor… | |
| CVE-2025-61247 | HIGH | 8.2 | 2025-10-27 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php. | |
| CVE-2025-12295 | MEDIUM | 6.6 | 2025-10-27 | A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing manipulation… | |
| CVE-2025-12296 | LOW | 4.7 | 2025-10-27 | A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handler. The manipu… | |
| CVE-2025-12297 | LOW | Patched | 4.3 | 2025-10-27 | A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclo… |
| CVE-2025-12298 | LOW | 4.3 | 2025-10-27 | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. This affects an unknown part of the file /editcategory.php. The manipulation of the argumen… | |
| CVE-2025-12299 | LOW | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The manipulation … | |
| CVE-2025-27222 | HIGH | Patched | 8.6 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input t… |
| CVE-2025-27223 | HIGH | Patched | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the… |
| CVE-2025-27224 | CRITICAL | Patched | 9.8 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this en… |
| CVE-2025-27225 | HIGH | Patched | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive… |
| CVE-2025-54967 | MEDIUM | Patched | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP use… |
| CVE-2025-54968 | HIGH | Patched | 8.8 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In some configurations, this may allow remote users to s… |
| CVE-2025-54969 | MEDIUM | Patched | 6.1 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user… |
| CVE-2025-54970 | MEDIUM | Patched | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allow remote or l… |