Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
61,203 matching · page 802/1225Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-21867(opens NVD record) | High | 7.8 | In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's data that didn't contain an Ethernet header. This occurs when bpf_prog_test_run_xdp() passes an invalid value as the user_data argument to bpf_test_init(). Fix this by returning an error when user_data is less than ETH_HLEN in bpf_test_init(). Additionally, remove the check for "if (user_size > size)" as it is unnecessary. [1] BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 __xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635 xdp_recv_frames net/bpf/test_run.c:272 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318 bpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371 __sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777 __do_sys_bpf kernel/bpf/syscall.c:5866 [inline] __se_sys_bpf kernel/bpf/syscall.c:5864 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864 x64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: free_pages_prepare mm/page_alloc.c:1056 [inline] free_unref_page+0x156/0x1320 mm/page_alloc.c:2657 __free_pages+0xa3/0x1b0 mm/page_alloc.c:4838 bpf_ringbuf_free kernel/bpf/ringbuf.c:226 [inline] ringbuf_map_free+0xff/0x1e0 kernel/bpf/ringbuf.c:235 bpf_map_free kernel/bpf/syscall.c:838 [inline] bpf_map_free_deferred+0x17c/0x310 kernel/bpf/syscall.c:862 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa2b/0x1b60 kernel/workqueue.c:3310 worker_thread+0xedf/0x1550 kernel/workqueue.c:3391 kthread+0x535/0x6b0 kernel/kthread.c:389 ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 CPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 | Mar 27, 2025 |
| CVE-2025-2783(opens NVD record) | High | 8.3 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) | Mar 26, 2025 |
| CVE-2022-39163(opens NVD record) | Medium | 4.7 | IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks. | Mar 26, 2025 |
| CVE-2023-52972(opens NVD record) | Medium | 5.5 | Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitation this vulnerability could lead to termination of some system processes. | Mar 26, 2025 |
| CVE-2024-31896(opens NVD record) | Medium | 5.9 | IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | Mar 25, 2025 |
| CVE-2024-58105(opens NVD record) | High | 7.3 | A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. This CVE address an addtional bypass not covered in CVE-2024-58104. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. | Mar 25, 2025 |
| CVE-2024-58104(opens NVD record) | High | 7.3 | A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. | Mar 25, 2025 |
| CVE-2025-26512(opens NVD record) | Critical | 9.9 | SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed. | Mar 24, 2025 |
| CVE-2023-25610(opens NVD record) | Critical | 9.8 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. | Mar 24, 2025 |
| CVE-2021-26105(opens NVD record) | Medium | 6.8 | A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authenticated attacker to potentially execute unauthorized code or commands via specifically crafted HTTP requests. | Mar 24, 2025 |
| CVE-2021-26091(opens NVD record) | High | 7.5 | A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials. | Mar 24, 2025 |
| CVE-2025-29806(opens NVD record) | Medium | 6.5 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | Mar 23, 2025 |
| CVE-2025-29795(opens NVD record) | High | 7.8 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | Mar 23, 2025 |
| CVE-2025-2610(opens NVD record) | High | 7.6 | Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. | Mar 21, 2025 |
| CVE-2025-2609(opens NVD record) | High | 8.2 | Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. | Mar 21, 2025 |
| CVE-2023-43029(opens NVD record) | Medium | 6.8 | IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment. | Mar 21, 2025 |
| CVE-2019-16151(opens NVD record) | Medium | 4.7 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override enabled/configured. | Mar 21, 2025 |
| CVE-2024-50053(opens NVD record) | Medium | 6.3 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. | Mar 21, 2025 |
| CVE-2025-26336(opens NVD record) | High | 8.3 | Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX version(s) prior to 3.41.200.202209300499, contain(s) a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | Mar 21, 2025 |
| CVE-2025-29814(opens NVD record) | Critical | 9.3 | Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. | Mar 21, 2025 |
| CVE-2025-29807(opens NVD record) | High | 8.7 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. | Mar 21, 2025 |
| CVE-2025-29217(opens NVD record) | Medium | 6.5 | Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. | Mar 20, 2025 |
| CVE-2024-8196(opens NVD record) | Critical | 9.8 | In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace. | Mar 20, 2025 |
| CVE-2024-8060(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7990(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7959(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7053(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7046(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7045(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7040(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7039(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7036(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7034(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-7033(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-12537(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-12534(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Mar 20, 2025 |
| CVE-2024-51459(opens NVD record) | High | 8.4 | IBM InfoSphere Information Server 11.7 could allow a local user to execute privileged commands due to the improper handling of permissions. | Mar 19, 2025 |
| CVE-2025-2324(opens NVD record) | Medium | 5.9 | Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2024.1.0 before 2024.1.2. | Mar 19, 2025 |
| CVE-2025-26475(opens NVD record) | Medium | 5.5 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping containers running during daemon restarts, reducing attack exposure, preventing accidental misconfigurations, and ensuring security controls remain active. | Mar 19, 2025 |
| CVE-2025-23382(opens NVD record) | Medium | 5.5 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, contain(s) an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.c | Mar 19, 2025 |
| CVE-2025-1758(opens NVD record) | Medium | 4.3 | Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above | Mar 19, 2025 |
| CVE-2024-45644(opens NVD record) | Medium | 4.7 | IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment. | Mar 19, 2025 |
| CVE-2024-56347(opens NVD record) | Critical | 9.6 | IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls. | Mar 18, 2025 |
| CVE-2024-56346(opens NVD record) | Critical | 10.0 | IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. | Mar 18, 2025 |
| CVE-2025-27688(opens NVD record) | High | 7.8 | Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | Mar 18, 2025 |
| CVE-2024-49822(opens NVD record) | Medium | 4.1 | IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | Mar 18, 2025 |
| CVE-2024-21760(opens NVD record) | High | 8.4 | An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker to execute arbitrary code on the host via a playbook code snippet. | Mar 18, 2025 |
| CVE-2023-47539(opens NVD record) | Critical | 9.8 | An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request. | Mar 18, 2025 |
| CVE-2025-22473(opens NVD record) | High | 7.8 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. | Mar 17, 2025 |
| CVE-2025-22472(opens NVD record) | High | 7.8 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to execution of commands with elevated privileges. | Mar 17, 2025 |