Search
43,411 CVEs
CVEs (43,411, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 43,411 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-112837 | HIGH | 8.5 | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue… | |
| CVE-2026-112835 | HIGH | 7.1 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects… | |
| CVE-2026-112825 | MEDIUM | 6.5 | 2026-10-23 | Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This is… | |
| CVE-2026-112821 | MEDIUM | 6.5 | 2026-10-23 | Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from … | |
| CVE-2026-112359 | HIGH | 7.5 | 2026-10-23 | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile… | |
| CVE-2025-58403 | MEDIUM | — | 2026-10-23 | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malic… | |
| CVE-2025-30054 | CRITICAL | — | 2026-10-23 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its … | |
| CVE-2025-30053 | MEDIUM | — | 2026-10-23 | The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versio… | |
| CVE-2025-30052 | HIGH | — | 2026-10-23 | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker… | |
| CVE-2025-30051 | MEDIUM | Patched | — | 2026-10-23 | The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file pe… |
| CVE-2025-30050 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untruste… |
| CVE-2025-30049 | HIGH | Patched | — | 2026-10-23 | The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3 |
| CVE-2025-30047 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, th… |
| CVE-2025-30046 | CRITICAL | — | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data … | |
| CVE-2025-30045 | HIGH | — | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evalu… | |
| CVE-2025-30043 | HIGH | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthe… |
| CVE-2026-93489 | HIGH | — | 2026-10-23 | Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to p… | |
| CVE-2026-75779 | HIGH | — | 2026-10-23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker t… | |
| CVE-2026-75775 | HIGH | — | 2026-10-23 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted … | |
| CVE-2026-63244 | CRITICAL | 9.8 | 2026-10-23 | An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authenti… | |
| CVE-2026-4952 | MEDIUM | — | 2026-10-23 | The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be… | |
| CVE-2026-4951 | MEDIUM | — | 2026-10-23 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The… | |
| CVE-2026-4950 | MEDIUM | — | 2026-10-23 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User proper… | |
| CVE-2026-63243 | MEDIUM | 4.3 | 2026-10-23 | An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect … | |
| CVE-2026-55981 | CRITICAL | 9.6 | 2026-10-23 | A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an … |