Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
57,659 matching · page 680/1154Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-8852(opens NVD record) | Medium | 4.3 | A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | Aug 11, 2025 |
| CVE-2025-8661(opens NVD record) | Medium | 6.1 | A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user. | Aug 11, 2025 |
| CVE-2025-8660(opens NVD record) | Critical | 9.8 | Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed. | Aug 11, 2025 |
| CVE-2024-58238(opens NVD record) | High | 7.1 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test This fixes the tx timeout issue seen while running a stress test on btnxpuart for couple of hours, such that the interval between two HCI commands coincide with the power save timeout value of 2 seconds. Test procedure using bash script: <load btnxpuart.ko> hciconfig hci0 up //Enable Power Save feature hcitool -i hci0 cmd 3f 23 02 00 00 while (true) do hciconfig hci0 leadv sleep 2 hciconfig hci0 noleadv sleep 2 done Error log, after adding few more debug prints: Bluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00 Bluetooth: hci0: Set UART break: on, status=0 Bluetooth: hci0: btnxpuart_tx_wakeup() tx_work scheduled Bluetooth: hci0: btnxpuart_tx_work() dequeue: 01 0A 20 01 00 Can't set advertise mode on hci0: Connection timed out (110) Bluetooth: hci0: command 0x200a tx timeout When the power save mechanism turns on UART break, and btnxpuart_tx_work() is scheduled simultaneously, psdata->ps_state is read as PS_STATE_AWAKE, which prevents the psdata->work from being scheduled, which is responsible to turn OFF UART break. This issue is fixed by adding a ps_lock mutex around UART break on/off as well as around ps_state read/write. btnxpuart_tx_wakeup() will now read updated ps_state value. If ps_state is PS_STATE_SLEEP, it will first schedule psdata->work, and then it will reschedule itself once UART break has been turned off and ps_state is PS_STATE_AWAKE. Tested above script for 50,000 iterations and TX timeout error was not observed anymore. | Aug 9, 2025 |
| CVE-2022-50233(opens NVD record) | High | 7.8 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} Both dev_name and short_name are not guaranteed to be NULL terminated so this instead use strnlen and then attempt to determine if the resulting string needs to be truncated or not. | Aug 9, 2025 |
| CVE-2025-8732(opens NVD record) | Low | 3.3 | A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all." | Aug 8, 2025 |
| CVE-2025-36119(opens NVD record) | High | 7.1 | IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator. | Aug 8, 2025 |
| CVE-2025-36023(opens NVD record) | Medium | 6.5 | IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key. | Aug 8, 2025 |
| CVE-2025-8088(opens NVD record) | High | 8.8 | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. | Aug 8, 2025 |
| CVE-2024-58257(opens NVD record) | Medium | 5.7 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. | Aug 8, 2025 |
| CVE-2024-58256(opens NVD record) | Medium | 4.5 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. | Aug 8, 2025 |
| CVE-2024-58255(opens NVD record) | Medium | 5.0 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. | Aug 8, 2025 |
| CVE-2025-53792(opens NVD record) | Critical | 9.1 | Azure Portal Elevation of Privilege Vulnerability | Aug 7, 2025 |
| CVE-2025-53787(opens NVD record) | High | 8.2 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability | Aug 7, 2025 |
| CVE-2025-53774(opens NVD record) | Medium | 6.5 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability | Aug 7, 2025 |
| CVE-2025-53767(opens NVD record) | Critical | 10.0 | Azure OpenAI Elevation of Privilege Vulnerability | Aug 7, 2025 |
| CVE-2025-26513(opens NVD record) | High | 7.0 | The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate their privileges. | Aug 7, 2025 |
| CVE-2025-7195(opens NVD record) | Medium | 6.4 | Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. | Aug 7, 2025 |
| CVE-2025-55077(opens NVD record) | High | 7.4 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01. | Aug 7, 2025 |
| CVE-2025-51629(opens NVD record) | High | 8.8 | A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter. | Aug 7, 2025 |
| CVE-2024-56339(opens NVD record) | Low | 3.7 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration. | Aug 7, 2025 |
| CVE-2024-55401(opens NVD record) | Medium | 6.5 | An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal. | Aug 7, 2025 |
| CVE-2024-52680(opens NVD record) | Medium | 6.1 | EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. | Aug 7, 2025 |
| CVE-2025-8583(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8582(opens NVD record) | Medium | 4.3 | Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8581(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8580(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8579(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Aug 7, 2025 |
| CVE-2025-8578(opens NVD record) | High | 8.8 | Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | Aug 7, 2025 |
| CVE-2025-8577(opens NVD record) | Medium | 4.3 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Aug 7, 2025 |
| CVE-2025-8576(opens NVD record) | High | 8.8 | Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) | Aug 7, 2025 |
| CVE-2025-51058(opens NVD record) | Medium | 6.5 | Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter. | Aug 6, 2025 |
| CVE-2025-51057(opens NVD record) | Medium | 6.5 | A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'. | Aug 6, 2025 |
| CVE-2025-51056(opens NVD record) | High | 8.2 | An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE). | Aug 6, 2025 |
| CVE-2025-51055(opens NVD record) | High | 8.6 | Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information. | Aug 6, 2025 |
| CVE-2025-51054(opens NVD record) | Medium | 6.5 | Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint. | Aug 6, 2025 |
| CVE-2025-51053(opens NVD record) | Medium | 6.1 | A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser. | Aug 6, 2025 |
| CVE-2025-51052(opens NVD record) | Medium | 6.5 | A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'. | Aug 6, 2025 |
| CVE-2024-55402(opens NVD record) | Medium | 5.3 | 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. | Aug 6, 2025 |
| CVE-2024-55399(opens NVD record) | Medium | 6.5 | 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF). | Aug 6, 2025 |
| CVE-2024-55398(opens NVD record) | Medium | 6.5 | 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions. | Aug 6, 2025 |
| CVE-2025-51624(opens NVD record) | High | 7.6 | Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0. | Aug 6, 2025 |
| CVE-2025-38747(opens NVD record) | High | 7.8 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges. | Aug 6, 2025 |
| CVE-2025-38746(opens NVD record) | Low | 3.5 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure. | Aug 6, 2025 |
| CVE-2025-8419(opens NVD record) | Medium | 5.3 | A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks. | Aug 6, 2025 |
| CVE-2025-53786(opens NVD record) | High | 8.0 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment. | Aug 6, 2025 |
| CVE-2025-36020(opens NVD record) | Medium | 5.9 | IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information. | Aug 6, 2025 |
| CVE-2025-2028(opens NVD record) | Medium | 6.5 | Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs | Aug 6, 2025 |
| CVE-2024-52885(opens NVD record) | Medium | 5.0 | The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway. | Aug 6, 2025 |
| CVE-2025-3354(opens NVD record) | High | 8.1 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. | Aug 6, 2025 |