Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive info…
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticate…
Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet …
Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated …
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message…
Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or …
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard…
Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing acce…
Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, s…
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:cr…
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or…
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not…
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that …
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filt…
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the …
Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in…
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal mes…
DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local p…
Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting a…
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host…