Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
22,396 matching · page 342/448Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-36119(opens NVD record) | High | 7.1 | IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator. | Aug 8, 2025 |
| CVE-2025-36023(opens NVD record) | Medium | 6.5 | IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key. | Aug 8, 2025 |
| CVE-2025-8088(opens NVD record) | High | 8.8 | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. | Aug 8, 2025 |
| CVE-2024-58257(opens NVD record) | Medium | 5.7 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. | Aug 8, 2025 |
| CVE-2024-58256(opens NVD record) | Medium | 4.5 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. | Aug 8, 2025 |
| CVE-2024-58255(opens NVD record) | Medium | 5.0 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. | Aug 8, 2025 |
| CVE-2025-53792(opens NVD record) | Critical | 9.1 | Azure Portal Elevation of Privilege Vulnerability | Aug 7, 2025 |
| CVE-2025-53787(opens NVD record) | High | 8.2 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability | Aug 7, 2025 |
| CVE-2025-53774(opens NVD record) | Medium | 6.5 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability | Aug 7, 2025 |
| CVE-2025-53767(opens NVD record) | Critical | 10.0 | Azure OpenAI Elevation of Privilege Vulnerability | Aug 7, 2025 |
| CVE-2025-26513(opens NVD record) | High | 7.0 | The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate their privileges. | Aug 7, 2025 |
| CVE-2025-7195(opens NVD record) | Medium | 6.4 | Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. | Aug 7, 2025 |
| CVE-2025-55077(opens NVD record) | High | 7.4 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01. | Aug 7, 2025 |
| CVE-2025-51629(opens NVD record) | High | 8.8 | A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter. | Aug 7, 2025 |
| CVE-2024-56339(opens NVD record) | Low | 3.7 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration. | Aug 7, 2025 |
| CVE-2024-55401(opens NVD record) | Medium | 6.5 | An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal. | Aug 7, 2025 |
| CVE-2024-52680(opens NVD record) | Medium | 6.1 | EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. | Aug 7, 2025 |
| CVE-2025-8583(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8582(opens NVD record) | Medium | 4.3 | Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8581(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8580(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8579(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8578(opens NVD record) | High | 8.8 | Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | Aug 7, 2025 |
| CVE-2025-8577(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Aug 7, 2025 |
| CVE-2025-8576(opens NVD record) | High | 8.8 | Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) | Aug 7, 2025 |
| CVE-2025-51058(opens NVD record) | Medium | 6.5 | Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter. | Aug 6, 2025 |
| CVE-2025-51057(opens NVD record) | Medium | 6.5 | A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'. | Aug 6, 2025 |
| CVE-2025-51056(opens NVD record) | High | 8.2 | An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE). | Aug 6, 2025 |
| CVE-2025-51055(opens NVD record) | High | 8.6 | Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information. | Aug 6, 2025 |
| CVE-2025-51054(opens NVD record) | Medium | 6.5 | Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint. | Aug 6, 2025 |
| CVE-2025-51053(opens NVD record) | Medium | 6.1 | A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser. | Aug 6, 2025 |
| CVE-2025-51052(opens NVD record) | Medium | 6.5 | A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'. | Aug 6, 2025 |
| CVE-2024-55402(opens NVD record) | Medium | 5.3 | 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. | Aug 6, 2025 |
| CVE-2024-55399(opens NVD record) | Medium | 6.5 | 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF). | Aug 6, 2025 |
| CVE-2024-55398(opens NVD record) | Medium | 6.5 | 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions. | Aug 6, 2025 |
| CVE-2025-51624(opens NVD record) | High | 7.6 | Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0. | Aug 6, 2025 |
| CVE-2025-38747(opens NVD record) | High | 7.8 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges. | Aug 6, 2025 |
| CVE-2025-38746(opens NVD record) | Low | 3.5 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure. | Aug 6, 2025 |
| CVE-2025-8419(opens NVD record) | Medium | 5.3 | A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks. | Aug 6, 2025 |
| CVE-2025-53786(opens NVD record) | High | 8.0 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment. | Aug 6, 2025 |
| CVE-2025-36020(opens NVD record) | Medium | 5.9 | IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information. | Aug 6, 2025 |
| CVE-2025-2028(opens NVD record) | Medium | 6.5 | Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs | Aug 6, 2025 |
| CVE-2024-52885(opens NVD record) | Medium | 5.0 | The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway. | Aug 6, 2025 |
| CVE-2025-3354(opens NVD record) | High | 8.1 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. | Aug 6, 2025 |
| CVE-2025-3320(opens NVD record) | High | 8.1 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. | Aug 6, 2025 |
| CVE-2025-23335(opens NVD record) | Medium | 4.4 | NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker could cause an underflow by a specific model configuration and a specific input. A successful exploit of this vulnerability might lead to denial of service. | Aug 6, 2025 |
| CVE-2025-23334(opens NVD record) | Medium | 5.9 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by sending a request. A successful exploit of this vulnerability might lead to information disclosure. | Aug 6, 2025 |
| CVE-2025-23333(opens NVD record) | Medium | 5.9 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by manipulating shared memory data. A successful exploit of this vulnerability might lead to information disclosure. | Aug 6, 2025 |
| CVE-2025-23331(opens NVD record) | High | 7.5 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive size value, leading to a segmentation fault, by providing an invalid request. A successful exploit of this vulnerability might lead to denial of service. | Aug 6, 2025 |
| CVE-2025-23327(opens NVD record) | High | 7.5 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through specially crafted inputs. A successful exploit of this vulnerability might lead to denial of service and data tampering. | Aug 6, 2025 |