Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially cr…
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2…
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 t…
An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attac…
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled …
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted…
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, …
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through…
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoi…
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the n…
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish e…
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-val…
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/…
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived …
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is…
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606…
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppPro…
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionali…
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker …
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, a…