Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
22,396 matching · page 344/448Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-54613(opens NVD record) | Medium | 5.9 | Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability. | Aug 6, 2025 |
| CVE-2025-54612(opens NVD record) | Medium | 5.9 | Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability. | Aug 6, 2025 |
| CVE-2025-54611(opens NVD record) | High | 7.3 | EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Aug 6, 2025 |
| CVE-2025-54610(opens NVD record) | Medium | 5.4 | Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability. | Aug 6, 2025 |
| CVE-2025-54609(opens NVD record) | Medium | 5.4 | Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability. | Aug 6, 2025 |
| CVE-2025-54608(opens NVD record) | Medium | 6.2 | Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Successful exploitation of this vulnerability may cause device screen orientation to be arbitrarily set. | Aug 6, 2025 |
| CVE-2025-54607(opens NVD record) | High | 7.7 | Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Aug 6, 2025 |
| CVE-2025-54606(opens NVD record) | High | 7.3 | Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. | Aug 6, 2025 |
| CVE-2025-54655(opens NVD record) | High | 8.1 | Race condition vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality and integrity of the virtualization graphics module. | Aug 6, 2025 |
| CVE-2025-54653(opens NVD record) | High | 8.4 | Path traversal vulnerability in the virtualization file module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization file module. | Aug 6, 2025 |
| CVE-2025-54652(opens NVD record) | High | 8.4 | Path traversal vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization module. | Aug 6, 2025 |
| CVE-2025-52237(opens NVD record) | Medium | 6.5 | An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal. | Aug 5, 2025 |
| CVE-2025-52078(opens NVD record) | Medium | 6.5 | File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted POST request to the /file-upload endpoint. | Aug 5, 2025 |
| CVE-2025-50592(opens NVD record) | Medium | 5.4 | Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player. | Aug 5, 2025 |
| CVE-2025-51857(opens NVD record) | Medium | 6.1 | The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks. | Aug 5, 2025 |
| CVE-2025-51628(opens NVD record) | High | 7.5 | Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to read confidential documents via the DocumentoId parameter. | Aug 5, 2025 |
| CVE-2025-51627(opens NVD record) | Medium | 6.5 | Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Administrator. | Aug 5, 2025 |
| CVE-2025-51060(opens NVD record) | Medium | 6.5 | An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCodes to perform RDMSR and WRMSR, respectively. Through this process, the attacker can modify MSR_LSTAR and hook KiSystemCall64. Afterward, using Return-Oriented Programming (ROP), the attacker can manipulate the stack with pre-prepared gadgets, disable the SMAP flag in the CR4 register, and execute a user-mode syscall handler in the kernel context. It has not been confirmed whether this works on 32-bit Windows, but it functions on 64-bit Windows if the core isolation feature is either absent or disabled. | Aug 5, 2025 |
| CVE-2025-44964(opens NVD record) | Low | 3.9 | A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive information. | Aug 5, 2025 |
| CVE-2024-52890(opens NVD record) | Medium | 6.1 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs. | Aug 5, 2025 |
| CVE-2025-54987(opens NVD record) | Critical | 9.4 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture. | Aug 5, 2025 |
| CVE-2025-54948(opens NVD record) | Critical | 9.4 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. | Aug 5, 2025 |
| CVE-2025-50341(opens NVD record) | Critical | 9.8 | A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter. An attacker can manipulate the SQL query logic and determine true/false conditions, potentially leading to data exposure or further exploitation. | Aug 4, 2025 |
| CVE-2025-52239(opens NVD record) | Critical | 9.8 | An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file. | Aug 4, 2025 |
| CVE-2025-38741(opens NVD record) | High | 7.5 | Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication. | Aug 4, 2025 |
| CVE-2025-26476(opens NVD record) | High | 8.4 | Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. | Aug 4, 2025 |
| CVE-2025-21120(opens NVD record) | High | 8.3 | Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. | Aug 4, 2025 |
| CVE-2025-51390(opens NVD record) | Critical | 9.8 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function. | Aug 4, 2025 |
| CVE-2025-46206(opens NVD record) | Medium | 6.5 | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | Aug 4, 2025 |
| CVE-2025-50420(opens NVD record) | Medium | 6.5 | An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS). | Aug 4, 2025 |
| CVE-2025-44963(opens NVD record) | Critical | 9.0 | RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key. | Aug 4, 2025 |
| CVE-2025-44962(opens NVD record) | Medium | 5.0 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files. | Aug 4, 2025 |
| CVE-2025-44961(opens NVD record) | Critical | 9.9 | In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user. | Aug 4, 2025 |
| CVE-2025-44960(opens NVD record) | High | 8.5 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. | Aug 4, 2025 |
| CVE-2025-44958(opens NVD record) | Medium | 5.3 | RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. | Aug 4, 2025 |
| CVE-2025-44957(opens NVD record) | High | 8.5 | Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. | Aug 4, 2025 |
| CVE-2025-44954(opens NVD record) | Critical | 9.0 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. | Aug 4, 2025 |
| CVE-2025-44955(opens NVD record) | High | 8.8 | RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password. | Aug 4, 2025 |
| CVE-2025-38739(opens NVD record) | High | 7.2 | Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to Information Disclosure. | Aug 4, 2025 |
| CVE-2025-44643(opens NVD record) | High | 8.6 | Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic. | Aug 4, 2025 |
| CVE-2025-36594(opens NVD record) | Critical | 9.8 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Remote unauthenticated user can create account that potentially expose customer info, affect system integrity and availability. | Aug 4, 2025 |
| CVE-2025-30099(opens NVD record) | High | 7.8 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges. | Aug 4, 2025 |
| CVE-2025-30098(opens NVD record) | Medium | 6.7 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges. | Aug 4, 2025 |
| CVE-2025-30097(opens NVD record) | Medium | 6.7 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges | Aug 4, 2025 |
| CVE-2025-30096(opens NVD record) | Medium | 6.7 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges. | Aug 4, 2025 |
| CVE-2025-36607(opens NVD record) | High | 7.8 | Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges. | Aug 4, 2025 |
| CVE-2025-36606(opens NVD record) | High | 7.8 | Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nfssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges. | Aug 4, 2025 |
| CVE-2025-36605(opens NVD record) | Medium | 6.1 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. | Aug 4, 2025 |
| CVE-2025-36604(opens NVD record) | High | 7.3 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution. | Aug 4, 2025 |
| CVE-2025-33118(opens NVD record) | Medium | 6.4 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Aug 1, 2025 |