CVE-2020-4210 | CRITICAL | 9.8 | 0.15491 | 44.62 | No | No | 2020-02-24 | 2024-09-16 | euvd | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially craf…IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020. |
CVE-2022-38424 | HIGH | 7.2 | 0.45159 | 44.61 | No | No | 2022-10-14 | 2025-04-23 | euvd | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restr…Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. Exploitation of this issue does not require user interaction, but does require administrator privileges. |
CVE-2019-5645 | HIGH | 7.5 | 0.41688 | 44.59 | No | No | 2020-09-01 | 2024-09-17 | euvd | By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular…By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server. |
CVE-2023-4355 | HIGH | 8.8 | 0.26819 | 44.59 | No | No | 2023-08-15 | 2025-05-05 | euvd | Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption v…Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
CVE-2021-34850 | HIGH | 7.8 | 0.38251 | 44.59 | No | No | 2021-08-04 | 2024-08-04 | euvd | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User intera…This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14529. |
CVE-2024-1305 | CRITICAL | 9.8 | 0.15379 | 44.58 | No | No | 2024-07-08 | 2024-08-23 | euvd | tap-windows6 driver version 9.26 and earlier does not properly
check the size data of incomming write operations which an attacker can
use…tap-windows6 driver version 9.26 and earlier does not properly
check the size data of incomming write operations which an attacker can
use to overflow memory buffers, resulting in a bug check and potentially
arbitrary code execution in kernel space |
CVE-2022-1802 | HIGH | 8.8 | 0.26709 | 44.55 | No | No | 2022-12-22 | 2025-04-16 | euvd | If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution …If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. |
CVE-2023-41998 | CRITICAL | 9.8 | 0.15274 | 44.55 | No | No | 2023-11-27 | 2024-08-02 | euvd | Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists tha…Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files. |
CVE-2018-3956 | MEDIUM | 6.8 | 0.49566 | 44.55 | No | No | 2019-01-30 | 2024-09-16 | euvd | An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader vers…An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read, which can disclose sensitive memory content and aid in exploitation when coupled with another vulnerability. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability. |
CVE-2026-27305 | HIGH | 8.6 | 0.28962 | 44.54 | No | No | 2026-04-14 | 2026-04-16 | cnvd, euvd, nvd | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traver…ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. |
CVE-2024-10542 | CRITICAL | 9.8 | 0.15236 | 44.53 | No | No | 2024-11-26 | 2026-04-08 | euvd | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due t…The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. |
CVE-2007-1383 | CRITICAL | 9.8 | 0.15195 | 44.52 | No | No | 2007-03-10 | 2025-04-03 | euvd | Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowi…Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286. |
CVE-2024-26305 | CRITICAL | 9.8 | 0.15163 | 44.51 | No | No | 2024-05-01 | 2024-08-02 | euvd | There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendin…There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. |
CVE-2023-39265 | LOW | 3.8 | 0.83716 | 44.5 | No | No | 2023-09-06 | 2025-02-13 | euvd | Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like…Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0. |
CVE-2022-41133 | HIGH | 8.8 | 0.26572 | 44.5 | No | No | 2022-10-27 | 2025-04-16 | euvd | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_setting…The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. |
CVE-1999-0208 | HIGH | 10.0 | 0.12856 | 44.5 | No | No | 1999-09-29 | 2024-08-01 | euvd, nvd | rpc.ypupdated (NIS) allows remote users to execute arbitrary commands.rpc.ypupdated (NIS) allows remote users to execute arbitrary commands. |
CVE-2022-39066 | HIGH | 8.8 | 0.26542 | 44.49 | No | No | 2022-11-22 | 2025-04-29 | euvd | There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an …There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection. |
CVE-2017-14459 | CRITICAL | 10.0 | 0.12827 | 44.49 | No | No | 2018-04-11 | 2024-09-16 | euvd | An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IE…An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH, Telnet, console), resulting in remote, unauthenticated, root-level operating system command execution. |
CVE-2022-2651 | CRITICAL | 9.8 | 0.15092 | 44.48 | No | No | 2022-08-04 | 2024-08-03 | euvd | Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5. |
CVE-2024-31138 | MEDIUM | 4.6 | 0.74492 | 44.47 | No | No | 2024-03-28 | 2024-08-02 | euvd | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingsIn JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings |
CVE-2026-39813 | CRITICAL | 9.1 | 0.2306 | 44.47 | No | Yes | 2026-04-14 | 2026-06-18 | euvd, packetstorm | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attack…A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests. |
CVE-2024-27497 | HIGH | 8.8 | 0.2646 | 44.46 | No | No | 2024-03-01 | 2024-08-16 | euvd | Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. |
CVE-2024-7332 | CRITICAL | 9.3 | 0.20737 | 44.46 | No | No | 2024-08-01 | 2024-08-06 | euvd | A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the f…A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
CVE-2024-10392 | CRITICAL | 9.8 | 0.1499 | 44.45 | No | No | 2024-10-31 | 2026-04-08 | euvd | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'hand…The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. |
CVE-2022-43938 | HIGH | 8.8 | 0.26436 | 44.45 | No | No | 2023-04-03 | 2025-02-11 | euvd | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator…Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. |
CVE-2020-4212 | CRITICAL | 9.8 | 0.14968 | 44.44 | No | No | 2020-02-24 | 2024-09-16 | euvd | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially craf…IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175023. |
CVE-2022-36971 | CRITICAL | 9.8 | 0.14984 | 44.44 | No | No | 2023-03-29 | 2025-02-18 | euvd | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although auth…This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the JwtTokenUtility class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15301. |
CVE-2023-21932 | HIGH | 7.2 | 0.44684 | 44.44 | No | No | 2023-04-18 | 2024-09-16 | euvd | Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The support…Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. While the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L). |
CVE-2023-28765 | CRITICAL | 9.8 | 0.14942 | 44.43 | No | No | 2023-04-11 | 2025-02-07 | euvd | An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get …An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application. |
CVE-2020-7361 | CRITICAL | 9.6 | 0.17225 | 44.43 | No | No | 2020-08-06 | 2024-09-16 | euvd | The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authe…The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system. |
CVE-2020-7048 | CRITICAL | 9.1 | 0.22928 | 44.42 | No | No | 2020-01-16 | 2024-08-04 | euvd | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the databas…The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI. |
CVE-2023-2114 | HIGH | 7.2 | 0.44629 | 44.42 | No | No | 2023-05-08 | 2025-02-04 | euvd | The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concate…The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query. |
CVE-2023-29452 | MEDIUM | 5.5 | 0.64063 | 44.42 | No | No | 2023-07-13 | 2024-10-22 | euvd | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when sele…Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. |
CVE-2019-1150 | HIGH | 8.8 | 0.26328 | 44.41 | No | No | 2019-08-14 | 2024-08-04 | euvd | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker …A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
There are multiple ways an attacker could exploit the vulnerability:
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or instant message that takes users to the attacker's website, or by opening an attachment sent through email.
In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit the vulnerability and then convince users to open the document file.
The security update addresses the vulnerability by correcting how the Windows font library handles embedded fonts. |
CVE-2024-6671 | CRITICAL | 9.8 | 0.14886 | 44.41 | No | No | 2024-08-29 | 2024-09-25 | euvd | In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability a…In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. |
CVE-2023-22855 | CRITICAL | 9.8 | 0.14832 | 44.39 | No | No | 2023-02-15 | 2025-03-19 | euvd | Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllab…Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote files on SMB shares. If one provides a file with the extension .t4, it is rendered with the .NET templating engine mono/t4, which can execute code. |
CVE-2024-37186 | CRITICAL | 9.1 | 0.22827 | 44.39 | No | No | 2025-01-14 | 2025-01-14 | euvd | An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially c…An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. |
CVE-2011-0663 | HIGH | 8.8 | 0.26221 | 44.38 | No | No | 2011-04-13 | 2025-01-21 | euvd | Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote atta…Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attackers to execute arbitrary code via a crafted web page, aka "Scripting Memory Reallocation Vulnerability." |
CVE-2025-8356 | CRITICAL | 9.8 | 0.14774 | 44.37 | No | No | 2025-08-08 | 2026-02-26 | euvd | In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. Thi…In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system. |
CVE-2024-36258 | CRITICAL | 10.0 | 0.12447 | 44.36 | No | No | 2025-01-14 | 2025-01-14 | euvd | A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210…A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability. |
CVE-2025-8723 | CRITICAL | 9.8 | 0.14731 | 44.36 | No | No | 2025-08-19 | 2026-04-08 | euvd | The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient san…The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution. |
CVE-2024-31445 | HIGH | 8.8 | 0.26154 | 44.35 | No | No | 2024-05-13 | 2025-12-16 | euvd | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automati…Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue. |
CVE-2025-41656 | CRITICAL | 10.0 | 0.12424 | 44.35 | No | No | 2025-07-01 | 2025-07-01 | euvd | An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for th…An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default. |
CVE-2012-0175 | HIGH | 8.8 | 0.26103 | 44.34 | No | No | 2012-07-10 | 2025-01-21 | euvd | The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Wind…The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory, aka "Command Injection Vulnerability." |
CVE-2026-45829 | CRITICAL | 10.0 | 0.12387 | 44.34 | No | No | 2026-05-18 | 2026-07-15 | euvd | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attack…A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. |
CVE-2023-2164 | MEDIUM | 5.4 | 0.64975 | 44.34 | No | No | 2023-08-01 | 2025-11-20 | euvd | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.…An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta. |
CVE-2025-11700 | HIGH | 8.4 | 0.307 | 44.34 | No | No | 2025-11-12 | 2025-12-15 | euvd | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosureN-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure |
CVE-2026-33309 | CRITICAL | 10.0 | 0.12363 | 44.33 | No | No | 2026-03-24 | 2026-03-25 | euvd | Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for C…Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix. |
CVE-2024-32030 | HIGH | 8.1 | 0.34085 | 44.33 | No | No | 2024-06-19 | 2024-08-02 | euvd | Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying…Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying their network address and port. As a separate feature, it also provides the ability to monitor the performance of Kafka brokers by connecting to their JMX ports. JMX is based on the RMI protocol, so it is inherently susceptible to deserialization attacks. A potential attacker can exploit this feature by connecting Kafka UI backend to its own malicious broker. This vulnerability affects the deployments where one of the following occurs: 1. dynamic.config.enabled property is set in settings. It's not enabled by default, but it's suggested to be enabled in many tutorials for Kafka UI, including its own README.md. OR 2. an attacker has access to the Kafka cluster that is being connected to Kafka UI. In this scenario the attacker can exploit this vulnerability to expand their access and execute code on Kafka UI as well. Instead of setting up a legitimate JMX port, an attacker can create an RMI listener that returns a malicious serialized object for any RMI call. In the worst case it could lead to remote code execution as Kafka UI has the required gadget chains in its classpath. This issue may lead to post-auth remote code execution. This is particularly dangerous as Kafka-UI does not have authentication enabled by default. This issue has been addressed in version 0.7.2. All users are advised to upgrade. There are no known workarounds for this vulnerability. These issues were discovered and reported by the GitHub Security lab and is also tracked as GHSL-2023-230. |
CVE-2021-29440 | HIGH | 8.4 | 0.30623 | 44.32 | No | No | 2021-04-13 | 2024-08-03 | euvd | Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to …Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11. |