cve.li

Recent

CVE-2025-15110CWE-434CWE-284

jackq XCMS Backend ProductImageController.class.php upload unrestricted upload

Published 2025-12-27 by VulDB

CVE-2025-14177CWE-125

Information Leak of Memory in getimagesize

Published 2025-12-27 by php

CVE-2025-14178CWE-787CWE-190

Heap buffer overflow in array_merge()

Published 2025-12-27 by php

CVE-2025-14180CWE-476

NULL Pointer Dereference in PDO quoting

Published 2025-12-27 by php

CVE-2025-15109CWE-434CWE-284

jackq XCMS upload.php unrestricted upload

Published 2025-12-27 by VulDB

CVE-2025-15108CWE-321CWE-320

PandaXGO PandaX JWT Secret config.yml hard-coded key

Published 2025-12-27 by VulDB

CVE-2025-15107CWE-321CWE-320

actiontech sqle JWT Secret jwt.go hard-coded key

Published 2025-12-27 by VulDB

CVE-2025-15106CWE-285CWE-266

getmaxun Authentication Endpoint auth.ts router.get improper authorization

Published 2025-12-27 by VulDB

CVE-2025-15105CWE-321CWE-320

getmaxun auth.ts hard-coded key

Published 2025-12-27 by VulDB

CVE-2025-59946CWE-416

NanoMQ has a Use After Free vulnerability via sub info list

Published 2025-12-27 by GitHub_M

CVE-2025-68952CWE-94

1-click Remote Code Execution (RCE) vulnerability in Eigent

Published 2025-12-27 by GitHub_M

CVE-2025-68948CWE-321

SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret

Published 2025-12-27 by GitHub_M

CVE-2025-68927CWE-79

Improper Neutralization of HTML Tags in a Web Page in libredesk

Published 2025-12-27 by GitHub_M

CVE-2025-54322CWE-95

Published 2025-12-27 by mitre

CVE-2025-68474CWE-787

ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling

Published 2025-12-26 by GitHub_M

CVE-2025-68473CWE-787

ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling

Published 2025-12-26 by GitHub_M

CVE-2025-68148CWE-770

FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

Published 2025-12-26 by GitHub_M

CVE-2025-68932CWE-338

FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

Published 2025-12-26 by GitHub_M

CVE-2025-66203CWE-78

StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection

Published 2025-12-26 by GitHub_M

CVE-2025-67729CWE-502

lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()

Published 2025-12-26 by GitHub_M

CVE-2025-68697CWE-269CWE-749

Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

Published 2025-12-26 by GitHub_M

CVE-2025-68668CWE-693

n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

Published 2025-12-26 by GitHub_M

CVE-2025-61914CWE-79

n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox

Published 2025-12-26 by GitHub_M

CVE-2025-13158CWE-1321

apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker

Published 2025-12-26 by Sonatype

CVE-2025-64645CWE-367

Time-of-check Time-of-use (TOCTOU) in IBM Concert Software.

Published 2025-12-26 by ibm

CVE-2025-36230CWE-80

XSS in IBM Aspera Faspex

Published 2025-12-26 by ibm

CVE-2025-36229CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera Faspex

Published 2025-12-26 by ibm

CVE-2025-36228CWE-279

Incorrect Execution-Assigned Permissions in IBM Aspera Faspex

Published 2025-12-26 by ibm

CVE-2025-36192CWE-862

Missing Authorization with the DS8900F and DS8A00 Hardware Management Console

Published 2025-12-26 by ibm

CVE-2025-14687CWE-602

Client-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center

Published 2025-12-26 by ibm

CVE-2025-13915CWE-305

Authentication bypass in IBM API Connect

Published 2025-12-26 by ibm

CVE-2025-12771CWE-119

IBM Concert Software Improper Restriction of Operations within the Bounds of a Memory Buffer.

Published 2025-12-26 by ibm

CVE-2025-1721CWE-244

BM Concert Software Improper Clearing of Heap Memory Before Release.

Published 2025-12-26 by ibm

CVE-2025-67450CWE-427

Published 2025-12-26 by Eaton

CVE-2025-59888CWE-428

Published 2025-12-26 by Eaton

CVE-2025-59887CWE-427

Published 2025-12-26 by Eaton

CVE-2025-62578CWE-319

DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information

Published 2025-12-26 by Deltaww

CVE-2025-8075CWE-20

Improper Input Validation

Published 2025-12-26 by Hanwha_Vision

CVE-2025-52601CWE-321

Hardcoding sensitive information

Published 2025-12-26 by Hanwha_Vision

CVE-2025-52600CWE-20

Improper Input Validation

Published 2025-12-26 by Hanwha_Vision

CVE-2025-68946CWE-79

Published 2025-12-26 by mitre

CVE-2025-52599CWE-269

Inadequate account permissions management

Published 2025-12-26 by Hanwha_Vision

CVE-2025-52598CWE-295

Insufficient certificate validation

Published 2025-12-26 by Hanwha_Vision

CVE-2025-15099CWE-287

simstudioai sim CRON Secret internal.ts improper authentication

Published 2025-12-26 by VulDB

CVE-2025-68945CWE-359

Published 2025-12-26 by mitre

CVE-2025-68944CWE-441

Published 2025-12-26 by mitre

CVE-2025-68943CWE-497

Published 2025-12-26 by mitre

CVE-2025-15098CWE-918

YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery

Published 2025-12-26 by VulDB

CVE-2025-68942CWE-79

Published 2025-12-26 by mitre

CVE-2025-15097CWE-287

Alteryx Server status improper authentication

Published 2025-12-26 by VulDB

CVE-2025-68941CWE-863

Published 2025-12-26 by mitre

CVE-2025-68940CWE-863

Published 2025-12-26 by mitre

CVE-2025-68939CWE-424

Published 2025-12-26 by mitre

CVE-2025-15095CWE-79CWE-94

postmanlabs httpbin core.py cross site scripting

Published 2025-12-26 by VulDB

CVE-2025-15094CWE-79CWE-94

sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting

Published 2025-12-26 by VulDB

CVE-2025-68938CWE-863

Published 2025-12-26 by mitre

CVE-2025-15093CWE-79CWE-94

sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting

Published 2025-12-26 by VulDB

CVE-2025-15092CWE-120CWE-119

UTT 进取 512W ConfigExceptMSN strcpy buffer overflow

Published 2025-12-26 by VulDB

CVE-2025-57403

Published 2025-12-26 by mitre

CVE-2025-66738

Published 2025-12-26 by mitre

CVE-2024-42718

Published 2025-12-26 by mitre

CVE-2025-66947

Published 2025-12-26 by mitre

CVE-2025-67015

Published 2025-12-26 by mitre

CVE-2025-67014

Published 2025-12-26 by mitre

CVE-2025-65885

Published 2025-12-26 by mitre

CVE-2024-29720

Published 2025-12-26 by mitre

CVE-2024-44065

Published 2025-12-26 by mitre

CVE-2025-67349

Published 2025-12-26 by mitre

CVE-2025-66737

Published 2025-12-26 by mitre

CVE-2025-67013

Published 2025-12-26 by mitre

CVE-2025-25341

Published 2025-12-26 by mitre

CVE-2025-68937CWE-61

Published 2025-12-25 by mitre

CVE-2025-15091CWE-120CWE-119

UTT 进取 512W formPictureUrl strcpy buffer overflow

Published 2025-12-25 by VulDB

CVE-2025-14913CWE-862

Frontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion

Published 2025-12-25 by Wordfence

CVE-2025-15090CWE-120CWE-119

UTT 进取 512W formConfigNoticeConfig strcpy buffer overflow

Published 2025-12-25 by VulDB

CVE-2025-15089CWE-120CWE-119

UTT 进取 512W APSecurity strcpy buffer overflow

Published 2025-12-25 by VulDB

CVE-2025-15088CWE-89CWE-74

ketr JEPaaS loadPostil postilService.loadPostils sql injection

Published 2025-12-25 by VulDB

CVE-2025-15087CWE-285CWE-266

youlaitech youlai-mall OrderController.java submitOrderPayment improper authorization

Published 2025-12-25 by VulDB

CVE-2025-15086CWE-284CWE-266

youlaitech youlai-mall MemberController.java getMemberByMobile access control

Published 2025-12-25 by VulDB

CVE-2025-68936CWE-79

Published 2025-12-25 by mitre

CVE-2025-68935CWE-79

Published 2025-12-25 by mitre

CVE-2025-15085CWE-285CWE-266

youlaitech youlai-mall Balance MemberController.java deductBalance improper authorization

Published 2025-12-25 by VulDB

CVE-2025-15084CWE-284CWE-266

youlaitech youlai-mall Order Payment OrderController.java orderService.payOrder access control

Published 2025-12-25 by VulDB

CVE-2025-15083CWE-1191

TOZED ZLT M30s UART on-chip debug and test interface with improper access control

Published 2025-12-25 by VulDB

CVE-2025-15082CWE-200CWE-284

TOZED ZLT M30s Web Management proc_post information disclosure

Published 2025-12-25 by VulDB

CVE-2025-15081CWE-77CWE-74

JD Cloud BE6500 jdcapi sub_4780 command injection

Published 2025-12-25 by VulDB

CVE-2025-2307CWE-79

XSS in Verisay Communication's Aidango

Published 2025-12-25 by TR-CERT

CVE-2025-2406CWE-79

XSS in Verisay Communication's Trizbi

Published 2025-12-25 by TR-CERT

CVE-2025-2405CWE-79

XSS in Verisay Communication's Titarus

Published 2025-12-25 by TR-CERT

CVE-2025-15078CWE-89CWE-74

itsourcecode Student Management System list_report.php sql injection

Published 2025-12-25 by VulDB

CVE-2025-15077CWE-89CWE-74

itsourcecode Student Management System form137.php sql injection

Published 2025-12-25 by VulDB

CVE-2025-15076CWE-22

Tenda CH22 public path traversal

Published 2025-12-25 by VulDB

CVE-2025-15075CWE-89CWE-74

itsourcecode Student Management System student_p.php sql injection

Published 2025-12-25 by VulDB

CVE-2025-15074CWE-89CWE-74

itsourcecode Online Frozen Foods Ordering System customer_details.php sql injection

Published 2025-12-25 by VulDB

CVE-2025-59683CWE-863

Published 2025-12-25 by mitre

CVE-2025-66443CWE-617

Published 2025-12-25 by mitre

CVE-2025-66378CWE-863

Published 2025-12-25 by mitre

CVE-2025-48704CWE-617

Published 2025-12-25 by mitre

CVE-2025-32095CWE-617

Published 2025-12-25 by mitre

CVE-2025-49088CWE-617

Published 2025-12-25 by mitre

CVE-2025-66377CWE-306

Published 2025-12-25 by mitre

CVE-2025-66379CWE-617

Published 2025-12-25 by mitre

CVE-2025-32096CWE-617

Published 2025-12-25 by mitre

CVE-2025-68922CWE-78

Published 2025-12-24 by mitre

CVE-2025-15073CWE-89CWE-74

itsourcecode Online Frozen Foods Ordering System contact_us.php sql injection

Published 2025-12-24 by VulDB

CVE-2025-68920CWE-862

Published 2025-12-24 by mitre

CVE-2025-68919CWE-532

Published 2025-12-24 by mitre

CVE-2025-68917CWE-79

Published 2025-12-24 by mitre

CVE-2025-8769CWE-20

MegaSys Computer Technologies Telenium Online Web Application Improper Input Validation

Published 2025-12-24 by icscert

CVE-2025-3232CWE-306

Mitsubishi Electric Europe smartRTU Missing Authentication for Critical Function

Published 2025-12-24 by icscert

CVE-2025-68916CWE-25

Published 2025-12-24 by mitre

CVE-2025-68915CWE-79

Published 2025-12-24 by mitre

CVE-2025-68914CWE-89

Published 2025-12-24 by mitre

CVE-2019-25258CWE-22

LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities

Published 2025-12-24 by VulnCheck

CVE-2019-25257CWE-426

LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation

Published 2025-12-24 by VulnCheck

CVE-2019-25256CWE-22

VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal

Published 2025-12-24 by VulnCheck

CVE-2019-25255CWE-78

VideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution

Published 2025-12-24 by VulnCheck

CVE-2019-25254CWE-352

KYOCERA Net Admin 3.4.0906 Cross-Site Request Forgery via User Administration

Published 2025-12-24 by VulnCheck

CVE-2019-25253CWE-611

KYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection

Published 2025-12-24 by VulnCheck

CVE-2019-25252CWE-352

Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change

Published 2025-12-24 by VulnCheck

CVE-2019-25251CWE-918

Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings

Published 2025-12-24 by VulnCheck

CVE-2019-25250CWE-352

Devolo dLAN 500 AV Wireless+ 3.1.0-1 Cross-Site Request Forgery

Published 2025-12-24 by VulnCheck

CVE-2019-25249CWE-266

devolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr

Published 2025-12-24 by VulnCheck

CVE-2019-25248CWE-306

Beward N100 M2.1.6 Unauthenticated RTSP Video Stream Disclosure

Published 2025-12-24 by VulnCheck

CVE-2019-25247CWE-352

Beward N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Vulnerability

Published 2025-12-24 by VulnCheck

CVE-2019-25246CWE-22

Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure

Published 2025-12-24 by VulnCheck

CVE-2019-25245CWE-732

Ross Video DashBoard 8.5.1 Privilege Escalation via Insecure Permissions

Published 2025-12-24 by VulnCheck

CVE-2019-25244CWE-79

Legrand BTicino Driver Manager F454 1.0.51 CSRF and Stored XSS Vulnerabilities

Published 2025-12-24 by VulnCheck

CVE-2019-25243CWE-78

FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test

Published 2025-12-24 by VulnCheck

CVE-2019-25242CWE-352

FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface

Published 2025-12-24 by VulnCheck

Load more ↓