Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic inte…
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be use…
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions.…
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions.…
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it a…
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate th…
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an orde…
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authen…
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.