Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-30008 |
medium | 5.1 | 0.0030 | 2026-11-08 | HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows aut | |
CVE-2025-30007 |
high | 8.7 | 0.0324 | 2026-11-08 | HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that al | |
CVE-2025-2611 |
critical | 9.3 | 0.0838 | 2026-11-08 | The ICTBroadcast application unsafely passes session cookie data to shell processing, allo | |
CVE-2025-15661 |
high | 8.3 | 0.0065 | 2026-11-08 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulne | |
CVE-2025-15617 |
high | 8.3 | 0.0040 | 2026-11-08 | 1 PoC | Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifac |
CVE-2025-15616 |
high | 7.1 | 0.0173 | 2026-11-08 | Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell inj | |
CVE-2025-15615 |
medium | 6.9 | 0.0053 | 2026-11-08 | Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an im | |
CVE-2025-15612 |
medium | 6.3 | 0.0022 | 2026-11-08 | Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability whe | |
CVE-2025-15602 |
high | 8.7 | 0.0052 | 2026-11-08 | 1 PoC | Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account priv |
CVE-2025-0520 |
critical | 9.4 | 0.0244 | 2026-11-08 | An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file | |
CVE-2024-23689 |
— | — | 0.0068 | 2026-11-08 | Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clic | |
CVE-2024-23688 |
— | — | 0.0049 | 2026-11-08 | Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire se | |
CVE-2024-23687 |
— | — | 0.0065 | 2026-11-08 | Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0. | |
CVE-2024-23686 |
— | — | 0.0060 | 2026-11-08 | DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant vers | |
CVE-2024-23685 |
— | — | 0.0053 | 2026-11-08 | Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 | |
CVE-2024-23684 |
— | — | 0.0092 | 2026-11-08 | Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Jav | |
CVE-2024-23683 |
— | — | 0.0036 | 2026-11-08 | Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when | |
CVE-2024-23682 |
— | — | 0.0035 | 2026-11-08 | Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an | |
CVE-2024-23681 |
— | — | 0.0034 | 2026-11-08 | Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when a | |
CVE-2024-23680 |
— | — | 0.0021 | 2026-11-08 | AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly valida | |
CVE-2024-23679 |
— | — | 0.0084 | 2026-11-08 | Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote a | |
CVE-2024-22051 |
— | — | 0.0145 | 2026-11-08 | CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. Th | |
CVE-2024-22050 |
— | — | 0.0092 | 2026-11-08 | Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthentic | |
CVE-2024-22049 |
— | — | 0.0129 | 2026-11-08 | httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. | |
CVE-2024-22048 |
— | — | 0.0050 | 2026-11-08 | govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripti | |
CVE-2024-21911 |
— | — | 0.0117 | 2026-11-08 | TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. | |
CVE-2024-21910 |
— | — | 0.0096 | 2026-11-08 | TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A rem | |
CVE-2024-21909 |
— | — | 0.0106 | 2026-11-08 | PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerabil | |
CVE-2024-21908 |
— | — | 0.0107 | 2026-11-08 | TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. | |
CVE-2024-21907 |
— | — | 0.3291 | 2026-11-08 | 1 PoC | Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditio |
CVE-2024-0758 |
— | — | 0.0057 | 2026-11-08 | MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can e | |
CVE-2024-0241 |
— | — | 0.0111 | 2026-11-08 | encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource cons | |
CVE-2023-7335 |
high | 8.7 | 0.0174 | 2026-11-08 | EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the class | |
CVE-2023-53957 |
high | 8.5 | 0.0059 | 2026-11-08 | Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user | |
CVE-2023-30798 |
high | 7.5 | 0.0130 | 2026-11-08 | There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 | |
CVE-2023-30797 |
high | 7.5 | 0.0079 | 2026-11-08 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating defau | |
CVE-2021-47872 |
high | 7.0 | 0.0027 | 2026-11-08 | SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archi | |
CVE-2020-37241 |
medium | 6.9 | 0.0015 | 2026-11-08 | bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attacke | |
CVE-2020-36851 |
critical | 9.5 | 0.0083 | 2026-11-08 | Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external | |
CVE-2019-25317 |
medium | 5.1 | 0.0030 | 2026-11-08 | Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to | |
CVE-2019-25264 |
medium | 5.1 | 0.0029 | 2026-11-08 | Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows author | |
CVE-2026-9323 |
critical | 9.2 | 0.0072 | 2026-11-08 | The urwid web display backend (urwid/display/web.py) generates web session identifiers (ur | |
CVE-2026-93990 |
high | 8.7 | 0.0041 | 2026-11-08 | Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by | |
CVE-2026-93349 |
high | 8.6 | 0.0212 | 2026-11-08 | 1 PoC | Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore c |
CVE-2026-8890 |
high | 8.2 | 0.0049 | 2026-11-08 | code100x contains an authentication bypass vulnerability in the Mobile API that allows una | |
CVE-2026-8851 |
high | 8.6 | 0.0032 | 2026-11-08 | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Contro | |
CVE-2026-8712 |
medium | 6.9 | 0.0032 | 2026-11-08 | 1 PoC | Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows una |
CVE-2026-89011 |
high | 7.1 | 0.0044 | 2026-11-08 | isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemote | |
CVE-2026-82641 |
high | 8.8 | 0.0060 | 2026-11-08 | Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP s | |
CVE-2026-82533 |
critical | 9.4 | 0.0124 | 2026-11-08 | DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that |