Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417953 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-21027 | 1 Samsung | 3 Android, Mobile, Samsung Mobile | 2025-09-11 | 5.1 Medium |
| Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM. | ||||
| CVE-2025-58176 | 1 Openagentplatform | 1 Dive | 2025-09-11 | 8.8 High |
| Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, there is a one-click Remote Code Execution vulnerability triggered through a custom url value, `transport` in the JSON object. An attacker can exploit the vulnerability in the following two scenarios: a victim visits a malicious website controlled by the attacker and the website redirect to the URL automatically, or a victim clicks on such a crafted link embedded on a legitimate website (e.g., in user-generated content). In both cases, the browser invokes Dive's custom URL handler (dive:), which launches the Dive app and processes the crafted URL, leading to arbitrary code execution on the victim’s machine. This vulnerability is caused by improper processing of custom url. This is fixed in version 0.9.4. | ||||
| CVE-2025-21025 | 2 Google, Samsung | 4 Android, Android, Mobile and 1 more | 2025-09-11 | 5.1 Medium |
| Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management. | ||||
| CVE-2025-55472 | 1 Tirreno | 1 Tirreno | 2025-09-11 | 6.5 Medium |
| SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization. | ||||
| CVE-2025-55373 | 1 Beakon | 1 Beakon | 2025-09-11 | 5.3 Medium |
| Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights. | ||||
| CVE-2025-55372 | 1 Beakon | 1 Beakon | 2025-09-11 | 5.3 Medium |
| An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. | ||||
| CVE-2025-9758 | 1 Deepakmisal24 | 1 Chemical Inventory Management System | 2025-09-11 | 6.3 Medium |
| A vulnerability was identified in deepakmisal24 Chemical Inventory Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /inventory_form.php. Such manipulation of the argument chem_name leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. | ||||
| CVE-2025-10298 | 2025-09-11 | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||||
| CVE-2025-9716 | 1 Zoneland | 1 O2oa | 2025-09-11 | 3.5 Low |
| A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_designer/jaxrs/form of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." | ||||
| CVE-2025-9175 | 1 Neurobin | 1 Shc | 2025-09-11 | 5.3 Medium |
| A vulnerability was identified in neurobin shc up to 4.0.3. This issue affects the function make of the file src/shc.c. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. | ||||
| CVE-2025-50901 | 1 Jeewms | 1 Jeewms | 2025-09-11 | 9.8 Critical |
| JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading. | ||||
| CVE-2025-50904 | 1 Winterchens | 1 My-site | 2025-09-11 | 9.8 Critical |
| There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /admin/ API without any token. | ||||
| CVE-2025-55444 | 1 Vishalmathur | 1 Online Artwork And Fine Arts Project | 2025-09-11 | 9.8 Critical |
| A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution. | ||||
| CVE-2024-53495 | 1 Winterchens | 1 My-site | 2025-09-11 | 7.5 High |
| Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. | ||||
| CVE-2024-57152 | 2 Winterchen, Winterchens | 2 My-site, My-site | 2025-09-11 | 7.5 High |
| Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen.interceptor.BaseInterceptor class | ||||
| CVE-2025-9263 | 1 Xuxueli | 1 Xxl-job | 2025-09-11 | 4.3 Medium |
| A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-9264 | 1 Xuxueli | 1 Xxl-job | 2025-09-11 | 5.4 Medium |
| A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used. | ||||
| CVE-2025-52194 | 1 Libsndfile Project | 1 Libsndfile | 2025-09-11 | 7.5 High |
| A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircam_read_header function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution. | ||||
| CVE-2025-9001 | 1 Lemonos | 2 Http Client, Lemonos | 2025-09-11 | 5.3 Medium |
| A vulnerability was determined in LemonOS up to nightly-2024-07-12 on LemonOS. Affected by this issue is the function HTTPGet of the file /Applications/Steal/main.cpp of the component HTTP Client. The manipulation of the argument chunkSize leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-9002 | 1 Surbowl | 1 Dormitory-management-php | 2025-09-11 | 7.3 High |
| A vulnerability was identified in Surbowl dormitory-management-php 1.0. This affects an unknown part of the file login.php. The manipulation of the argument Account leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. | ||||