Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for a…
NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after o…
NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected…
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in t…
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate…
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, t…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::quer…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read in…
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 605…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but…
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer dra…
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does n…
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 …
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to…
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 …
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authenticat…