Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as ad…
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysi…
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attack…
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with …
TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI s…
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Att…
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make…
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or auth…
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString…
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when S…
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short …
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials…
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue…
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMB…
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attacker…
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an …
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a…
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP arch…
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive w…
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TI…