Browse All CVEs
50,488 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-14512 |
medium | 6.5 | 0.0062 | 2026-11-05 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-s | |
CVE-2025-14242 |
medium | 6.5 | 0.0081 | 2026-11-05 | A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an int | |
CVE-2025-14104 |
medium | 6.1 | 0.0022 | 2026-11-05 | A flaw was found in util-linux. This vulnerability allows a heap buffer overread when proc | |
CVE-2025-14087 |
critical | 9.8 | 0.0089 | 2026-11-05 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause | |
CVE-2025-13601 |
high | 7.7 | 0.0035 | 2026-11-05 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of | |
CVE-2025-13193 |
medium | 5.5 | 0.0013 | 2026-11-05 | A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly | |
CVE-2025-12801 |
medium | 6.5 | 0.0051 | 2026-11-05 | A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package | |
CVE-2026-106715 |
medium | 5.4 | 0.0019 | 2026-11-05 | NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebVie | |
CVE-2026-106714 |
high | 8.1 | 0.0029 | 2026-11-05 | Chewy for Android version 26.23.0 does not adequately validate the host of a product-detai | |
CVE-2026-106713 |
high | 7.5 | 0.0039 | 2026-11-05 | An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensit | |
CVE-2026-106716 |
medium | 6.5 | 0.0029 | 2026-11-05 | ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied thr | |
CVE-2026-84183 |
high | 8.8 | 0.0115 | 2026-11-05 | Incorrect Authorization in the updateLayout simple-method in applications/content/minilang | |
CVE-2026-83542 |
critical | 9.8 | 0.0137 | 2026-11-05 | 1 PoC | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24. |
CVE-2026-83538 |
medium | 5.3 | 0.0068 | 2026-11-05 | Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remo | |
CVE-2026-82960 |
high | 8.8 | 0.0079 | 2026-11-05 | Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache | |
CVE-2026-82916 |
high | 7.1 | 0.0065 | 2026-11-05 | Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms | |
CVE-2026-82912 |
high | 8.8 | 0.0083 | 2026-11-05 | Improper Neutralization of Special Elements Used in an Expression Language Statement ('Exp | |
CVE-2026-82910 |
high | 8.8 | 0.0080 | 2026-11-05 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Templa | |
CVE-2026-82907 |
critical | 9.8 | 0.0087 | 2026-11-05 | Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 | |
CVE-2026-82904 |
high | 7.5 | 0.0069 | 2026-11-05 | Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before | |
CVE-2026-82902 |
medium | 4.3 | 0.0054 | 2026-11-05 | Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all p | |
CVE-2026-123028 |
medium | 6.9 | 0.0036 | 2026-11-05 | A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this iss | |
CVE-2025-64062 |
high | 8.8 | 0.0031 | 2026-11-05 | The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filter | |
CVE-2025-63216 |
critical | 10.0 | 0.0076 | 2026-11-05 | The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to | |
CVE-2025-63215 |
high | 7.2 | 0.0050 | 2026-11-05 | The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (R | |
CVE-2025-63228 |
critical | 9.8 | 0.0082 | 2026-11-05 | The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an | |
CVE-2025-63227 |
high | 7.2 | 0.0061 | 2026-11-05 | The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an | |
CVE-2025-63226 |
medium | 5.7 | 0.0022 | 2026-11-05 | The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is v | |
CVE-2025-63955 |
high | 7.5 | 0.0024 | 2026-11-05 | A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of | |
CVE-2025-63749 |
medium | 6.5 | 0.0098 | 2026-11-05 | pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter. | |
CVE-2025-63693 |
medium | 5.4 | 0.0019 | 2026-11-05 | The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks | |
CVE-2025-63225 |
critical | 9.8 | 0.0065 | 2026-11-05 | The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Ac | |
CVE-2025-60455 |
high | 8.4 | 0.0033 | 2026-11-05 | Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when t | |
CVE-2025-56499 |
medium | 6.5 | 0.0033 | 2026-11-05 | 1 PoC | Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level |
CVE-2025-54321 |
critical | 9.8 | 0.0050 | 2026-11-05 | 1 PoC | In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset passwo |
CVE-2025-54320 |
medium | 4.3 | 0.0035 | 2026-11-05 | 1 PoC | In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user |
CVE-2025-64076 |
high | 7.5 | 0.0049 | 2026-11-05 | Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_ | |
CVE-2025-63828 |
medium | 6.1 | 0.0023 | 2026-11-05 | Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate | |
CVE-2025-63695 |
critical | 9.8 | 0.0042 | 2026-11-05 | DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/ | |
CVE-2025-63694 |
critical | 9.8 | 0.0038 | 2026-11-05 | DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage. | |
CVE-2025-63514 |
medium | 6.1 | 0.0021 | 2026-11-05 | kishan0725 Hospital Management System has a Cross-Site Scripting (XSS) vulnerability in ap | |
CVE-2025-56643 |
critical | 9.1 | 0.0038 | 2026-11-05 | 1 PoC | Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a u |
CVE-2025-63829 |
high | 7.5 | 0.0034 | 2026-11-05 | eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer ove | |
CVE-2025-63513 |
medium | 6.5 | 0.0029 | 2026-11-05 | kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vu | |
CVE-2025-63512 |
medium | 6.5 | 0.0026 | 2026-11-05 | kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.p | |
CVE-2025-63258 |
medium | 6.5 | 0.0037 | 2026-11-05 | A remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series | |
CVE-2025-56527 |
high | 7.5 | 0.0046 | 2026-11-05 | Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. | |
CVE-2025-56526 |
medium | 6.1 | 0.0044 | 2026-11-05 | 1 PoC | Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute |
CVE-2025-55796 |
high | 7.5 | 0.0063 | 2026-11-05 | The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tok | |
CVE-2025-63800 |
high | 7.5 | 0.0048 | 2026-11-05 | The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their |