Thu, Mar 12 · 04:15 PM CDTCVE-2020-0796
10.0/10 · Must read/watchNVDvuln
Summary
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVECVE-2020-0796
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 12 · 04:15 PM CDT
ModifiedThu, Oct 01 · 08:17 PM CDT
CVE-2010-2861
9.8/10 · Must read/watchNVDvuln
Summary
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm
CVECVE-2010-2861
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 11 · 06:47 PM CDT
ModifiedThu, Oct 01 · 08:17 PM CDT
CVE-2012-1710
9.8/10 · Must read/watchNVDvuln
Summary
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.
CVECVE-2012-1710
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 03 · 10:55 PM CDT
ModifiedThu, Oct 01 · 08:17 PM CDT
CVE-2016-1019
9.8/10 · Must read/watchNVDvuln
Summary
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVECVE-2016-1019
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 07 · 10:59 AM CDT
ModifiedThu, Oct 01 · 08:17 PM CDT
CVE-2018-19323
9.8/10 · Must read/watchNVDvuln
Summary
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CVECVE-2018-19323
SeverityCRITICAL
TypeUPDATED
PublishedFri, Dec 21 · 11:29 PM CST
ModifiedThu, Oct 01 · 09:17 PM CDT
CVE-2018-19949
9.8/10 · Must read/watchNVDvuln
Summary
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.116
CVECVE-2018-19949
SeverityCRITICAL
TypeUPDATED
PublishedWed, Oct 28 · 06:15 PM CDT
ModifiedFri, Oct 02 · 04:17 AM CDT
CVE-2018-7602
9.8/10 · Must read/watchNVDvuln
Summary
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution -
CVECVE-2018-7602
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 19 · 05:29 PM CDT
ModifiedThu, Oct 01 · 09:17 PM CDT
CVE-2019-2725
9.8/10 · Must read/watchNVDvuln
Summary
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successf
CVECVE-2019-2725
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 26 · 07:29 PM CDT
ModifiedThu, Oct 01 · 09:17 PM CDT
CVE-2020-12812
9.8/10 · Must read/watchNVDvuln
Summary
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
CVECVE-2020-12812
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jul 24 · 11:15 PM CDT
ModifiedThu, Oct 01 · 09:17 PM CDT
CVE-2025-59741
9.8/10 · Must read/watchNVDvuln
Summary
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/CLT/LOGINERRORFRM.ASP'.
CVECVE-2025-59741
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 02 · 03:15 PM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-6544
9.8/10 · Must read/watchNVDvuln
Summary
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL enco
CVECVE-2025-6544
SeverityCRITICAL
TypeUPDATED
PublishedSun, Sep 21 · 09:15 AM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-8359
9.8/10 · Must read/watchNVDvuln
Summary
The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including administrators, w
CVECVE-2025-8359
SeverityCRITICAL
TypeUPDATED
PublishedSat, Sep 06 · 03:15 AM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-58255
9.6/10 · Must read/watchNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through <= 0.5.
CVECVE-2025-58255
SeverityCRITICAL
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-59557
9.3/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.
CVECVE-2025-59557
SeverityCRITICAL
TypeUPDATED
PublishedWed, Oct 22 · 03:15 PM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-10134
9.1/10 · Must read/watchNVDvuln
Summary
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files
CVECVE-2025-10134
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 09:15 AM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-37729
9.1/10 · Must read/watchNVDvuln
Summary
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
CVECVE-2025-37729
SeverityCRITICAL
TypeUPDATED
PublishedMon, Oct 13 · 02:15 PM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-8053
9.1/10 · Must read/watchNVDvuln
Summary
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low privilege user to interact with the backend API without sufficient privileges. This issue affects Flipper: 3.1.2.
CVECVE-2025-8053
SeverityCRITICAL
TypeUPDATED
PublishedMon, Oct 20 · 08:15 PM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-0282
9.0/10 · Must read/watchNVDvuln
Summary
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVECVE-2025-0282
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jan 08 · 11:15 PM CST
ModifiedThu, Oct 01 · 07:17 PM CDT
CVE-2017-6884
8.8/10 · Worth your timeNVDvuln
Summary
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parame
CVECVE-2017-6884
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 06 · 05:59 PM CDT
ModifiedThu, Oct 01 · 07:17 PM CDT
CVE-2021-26411
8.8/10 · Worth your timeNVDvuln
Summary
Internet Explorer Memory Corruption Vulnerability
CVECVE-2021-26411
SeverityHIGH
TypeUPDATED
PublishedThu, Mar 11 · 04:15 PM CST
ModifiedThu, Oct 01 · 09:17 PM CDT
CVE-2024-7399
8.8/10 · Worth your timeNVDvuln
Summary
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
CVECVE-2024-7399
SeverityHIGH
TypeUPDATED
PublishedMon, Aug 12 · 01:38 PM CDT
ModifiedThu, Oct 01 · 07:17 PM CDT
CVE-2025-12234
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVECVE-2025-12234
SeverityHIGH
TypeUPDATED
PublishedMon, Oct 27 · 07:15 AM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2025-6558
8.8/10 · Worth your timeNVDvuln
Summary
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2025-6558
SeverityHIGH
TypeUPDATED
PublishedTue, Jul 15 · 06:15 PM CDT
ModifiedThu, Oct 01 · 12:00 PM CDT
CVE-2025-9364
8.8/10 · Worth your timeNVDvuln
Summary
An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data.
CVECVE-2025-9364
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 09 · 01:15 PM CDT
ModifiedThu, Oct 01 · 04:10 PM CDT
CVE-2024-58274
8.3/10 · Worth your timeNVDvuln
Summary
Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.
CVECVE-2024-58274
SeverityHIGH
TypeUPDATED
PublishedWed, Oct 22 · 04:15 AM CDT
ModifiedFri, Oct 02 · 12:10 AM CDT
