Browse All CVEs
50,489 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-63527 |
medium | 5.4 | 0.0035 | 2026-11-04 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 | |
CVE-2025-63526 |
medium | 5.4 | 0.0035 | 2026-11-04 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System with | |
CVE-2025-63525 |
high | 8.8 | 0.0053 | 2026-11-04 | An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attacke | |
CVE-2025-63523 |
medium | 6.5 | 0.0028 | 2026-11-04 | FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are p | |
CVE-2025-63522 |
medium | 4.6 | 0.0021 | 2026-11-04 | Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function | |
CVE-2025-63520 |
medium | 6.1 | 0.0026 | 2026-11-04 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the Use | |
CVE-2025-65892 |
medium | 6.1 | 0.0025 | 2026-11-04 | Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unau | |
CVE-2025-65540 |
medium | 6.1 | 0.0020 | 2026-11-04 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper ha | |
CVE-2025-12183 |
high | 8.8 | 0.0075 | 2026-11-04 | Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attacke | |
CVE-2025-51736 |
medium | 6.3 | 0.0021 | 2026-11-04 | File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
CVE-2025-51733 |
medium | 5.5 | 0.0011 | 2026-11-04 | Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
CVE-2025-65202 |
high | 8.0 | 0.0669 | 2026-11-04 | TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability | |
CVE-2025-65670 |
medium | 4.3 | 0.0026 | 2026-11-04 | 1 PoC | An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access |
CVE-2025-65278 |
high | 7.5 | 0.0026 | 2026-11-04 | An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allo | |
CVE-2025-65276 |
critical | 9.8 | 0.0043 | 2026-11-04 | An unauthenticated administrative access vulnerability exists in the open-source HashTech | |
CVE-2025-50433 |
critical | 9.8 | 0.0046 | 2026-11-04 | 1 PoC | An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain esca |
CVE-2025-65681 |
low | 3.3 | 0.0023 | 2026-11-04 | 1 PoC | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing |
CVE-2025-65676 |
medium | 5.4 | 0.0025 | 2026-11-04 | 1 PoC | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authentic |
CVE-2025-65672 |
high | 7.5 | 0.0038 | 2026-11-04 | 1 PoC | Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share an |
CVE-2025-65669 |
critical | 9.1 | 0.0050 | 2026-11-04 | 1 PoC | An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses |
CVE-2025-26155 |
critical | 9.8 | 0.0061 | 2026-11-04 | NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untru | |
CVE-2025-55469 |
critical | 9.8 | 0.0045 | 2026-11-04 | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges an | |
CVE-2025-65239 |
medium | 4.3 | 0.0031 | 2026-11-04 | Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gatew | |
CVE-2025-65238 |
medium | 6.5 | 0.0036 | 2026-11-04 | Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Ga | |
CVE-2025-65237 |
medium | 6.1 | 0.0029 | 2026-11-04 | A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Re | |
CVE-2025-65236 |
critical | 9.8 | 0.0048 | 2026-11-04 | OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vuln | |
CVE-2025-65235 |
critical | 9.8 | 0.0048 | 2026-11-04 | OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQ | |
CVE-2025-63938 |
medium | 6.5 | 0.0028 | 2026-11-04 | Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_po | |
CVE-2025-56396 |
high | 8.8 | 0.0035 | 2026-11-04 | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due | |
CVE-2025-50402 |
critical | 9.8 | 0.0045 | 2026-11-04 | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_8043578 | |
CVE-2025-50399 |
critical | 9.8 | 0.0045 | 2026-11-04 | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_8043578 | |
CVE-2025-46174 |
high | 7.5 | 0.0033 | 2026-11-04 | Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope | |
CVE-2025-45311 |
high | 8.8 | 0.0040 | 2026-11-04 | Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privile | |
CVE-2025-65647 |
medium | 4.3 | 0.0026 | 2026-11-04 | Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online S | |
CVE-2025-51742 |
critical | 9.8 | 0.0051 | 2026-11-04 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerial | |
CVE-2025-64067 |
medium | 5.3 | 0.0025 | 2026-11-04 | Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filt | |
CVE-2025-64065 |
high | 8.8 | 0.0031 | 2026-11-04 | The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessa | |
CVE-2025-64064 |
high | 8.8 | 0.0031 | 2026-11-04 | Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permiss | |
CVE-2025-64063 |
critical | 9.8 | 0.0041 | 2026-11-04 | Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks wh | |
CVE-2026-42170 |
high | 7.8 | 0.0019 | 2026-11-04 | A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) fil | |
CVE-2026-122038 |
medium | 6.9 | 0.0025 | 2026-11-04 | A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278 | |
CVE-2026-115770 |
critical | 9.6 | 0.0017 | 2026-11-04 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to ser | |
CVE-2026-52722 |
high | 7.1 | 0.0039 | 2026-11-04 | A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted V | |
CVE-2026-52720 |
high | 8.8 | 0.0064 | 2026-11-04 | A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The | |
CVE-2026-52719 |
high | 7.1 | 0.0034 | 2026-11-04 | An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-pl | |
CVE-2026-50264 |
high | 7.8 | 0.0015 | 2026-11-04 | An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/ | |
CVE-2026-50261 |
high | 7.8 | 0.0015 | 2026-11-04 | A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). | |
CVE-2026-50260 |
high | 7.8 | 0.0015 | 2026-11-04 | A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A cli | |
CVE-2026-50259 |
high | 7.8 | 0.0016 | 2026-11-04 | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMa | |
CVE-2026-50258 |
high | 7.8 | 0.0016 | 2026-11-04 | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X ser |