Export limit exceeded: 343363 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (343363 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-57184 | 1 Gpac | 1 Gpac | 2025-06-27 | 5.5 Medium |
| An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163 that can cause a denial of service (DOS) via a crafted MP4 file. | ||||
| CVE-2024-57041 | 1 Nodebb | 1 Nodebb | 2025-06-27 | 4.6 Medium |
| A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile. | ||||
| CVE-2024-52012 | 1 Apache | 1 Solr | 2025-06-27 | 5.4 Medium |
| Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem. This issue affects Apache Solr: from 6.6 through 9.7.0. Users are recommended to upgrade to version 9.8.0, which fixes the issue. Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users. | ||||
| CVE-2025-24357 | 1 Vllm | 1 Vllm | 2025-06-27 | 7.5 High |
| vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0. | ||||
| CVE-2025-0725 | 3 Haxx, Netapp, Zlib | 12 Curl, Libcurl, Hci Baseboard Management Controller and 9 more | 2025-06-27 | 7.3 High |
| When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. | ||||
| CVE-2024-11628 | 1 Progress | 1 Kendo Ui For Vue | 2025-06-27 | 4.1 Medium |
| In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection. | ||||
| CVE-2023-24651 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 5.4 Medium |
| Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the registration page. | ||||
| CVE-2023-24732 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the user profile update function. | ||||
| CVE-2023-24730 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update function. | ||||
| CVE-2023-24729 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function. | ||||
| CVE-2023-24731 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the user profile update function. | ||||
| CVE-2023-24728 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the user profile update function. | ||||
| CVE-2023-24656 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under the Create Ticket function. | ||||
| CVE-2023-24364 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel. | ||||
| CVE-2023-24652 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter under the Create ticket function. | ||||
| CVE-2023-24653 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password function. | ||||
| CVE-2023-24654 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 8.8 High |
| Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Request a Quote function. | ||||
| CVE-2023-24655 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-06-27 | 9.8 Critical |
| Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Profile Update function. | ||||
| CVE-2024-57052 | 1 Youdiancms | 1 Youdiancms | 2025-06-27 | 9.8 Critical |
| An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file. | ||||
| CVE-2024-34732 | 1 Google | 1 Android | 2025-06-27 | 8.4 High |
| In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||