Export limit exceeded: 337795 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 337795 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 337795 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (337795 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-41099 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 6.5 Medium |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the list of permissions using unauthorised internal identifiers. | ||||
| CVE-2025-41098 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 7.5 High |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a misuse of the general enquiry web service. | ||||
| CVE-2025-41097 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 4.3 Medium |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic employee details using unauthorised internal identifiers. | ||||
| CVE-2025-41096 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 4.3 Medium |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the dates of the current contract details using unauthorised internal identifiers. | ||||
| CVE-2025-41095 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 4.3 Medium |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unauthorised internal identifiers. | ||||
| CVE-2025-41094 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 4.3 Medium |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to functional contract details using unauthorised internal identifiers. | ||||
| CVE-2025-41093 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 4.3 Medium |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract details using unauthorised internal identifiers. | ||||
| CVE-2025-41092 | 2 Boldworkplanner, Gps | 2 Bold Workplanner, Bold Workplanner | 2025-10-08 | 4.3 Medium |
| Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records details using unauthorised internal identifiers. | ||||
| CVE-2025-57407 | 1 Gp247 | 1 Gp247 | 2025-10-08 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions. | ||||
| CVE-2025-56304 | 1 Yzmcms | 1 Yzmcms | 2025-10-08 | 6.1 Medium |
| Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page. | ||||
| CVE-2025-52905 | 1 Totolink | 2 X6000r, X6000r Firmware | 2025-10-08 | 7.5 High |
| Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207. | ||||
| CVE-2025-55780 | 1 Artifex | 1 Mupdf | 2025-10-08 | 7.5 High |
| A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | ||||
| CVE-2025-56394 | 1 Free5gc | 1 Free5gc | 2025-10-08 | 7.5 High |
| Free5gc 4.0.1 is vulnerable to Buffer Overflow. The AMF incorrectly validates the 5GS mobile identity, resulting in slice reference overflow. | ||||
| CVE-2025-51005 | 2 Appneta, Broadcom | 2 Tcpreplay, Tcpreplay | 2025-10-08 | 7.5 High |
| A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1. When a crafted pcap file is processed, the program incorrectly handles memory in the checksum calculation logic at do_checksum_math_liveplay in tcpliveplay.c, leading to a possible denial of service. | ||||
| CVE-2025-54081 | 2 Lizardbyte, Microsoft | 2 Sunshine, Windows | 2025-10-08 | 6.7 Medium |
| Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222. | ||||
| CVE-2025-59534 | 1 Nasa | 1 Cryptolib | 2025-10-08 | 7.3 High |
| CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.2, there is a command Injection vulnerability in initialize_kerberos_keytab_file_login(). The vulnerability exists because the code directly interpolates user-controlled input into a shell command and executes it via system() without any sanitization or validation. This issue has been patched in version 1.4.2. | ||||
| CVE-2025-59822 | 2 Http4s, Typelevel | 2 Http4s, Http4s | 2025-10-08 | 7.5 High |
| Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31. | ||||
| CVE-2025-5098 | 1 Dynamixsoftware | 1 Printershare | 2025-10-08 | 9.1 Critical |
| PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization. | ||||
| CVE-2025-5099 | 1 Dynamixsoftware | 1 Printershare | 2025-10-08 | 9.8 Critical |
| An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution. | ||||
| CVE-2025-5100 | 1 Dynamixsoftware | 1 Printershare | 2025-10-08 | 8 High |
| A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code execution. | ||||