Total
29997 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2005-1439 | 1 Enhancesoft | 1 Osticket | 2026-07-10 | 7.5 HIGH | N/A |
| Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter. | |||||
| CVE-2006-5407 | 1 Enhancesoft | 1 Osticket | 2026-07-10 | 7.5 HIGH | N/A |
| PHP remote file inclusion vulnerability in open_form.php in osTicket allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter. | |||||
| CVE-2005-1436 | 1 Enhancesoft | 1 Osticket | 2026-07-10 | 6.8 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t parameter to view.php, (2) the osticket_title parameter to header.php, (3) the em parameter to admin_login.php, (4) the e parameter to user_login.php, (5) the err parameter to open_submit.php, or (6) the name and subject fields when adding a ticket. | |||||
| CVE-2026-55112 | 1 Ui | 38 Enterprise Network Video Recorder, Enterprise Network Video Recorder Core, Enterprise Network Video Recorder Core Firmware and 35 more | 2026-07-10 | N/A | 7.5 HIGH |
| A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device. | |||||
| CVE-2026-55110 | 1 Ui | 59 Enterprise Firewall Core, Enterprise Firewall Core Firmware, Enterprise Fortress Gateway and 56 more | 2026-07-09 | N/A | 7.5 HIGH |
| A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session. | |||||
| CVE-2026-55116 | 1 Ui | 1 Unifi Connect | 2026-07-09 | N/A | 9.0 CRITICAL |
| A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices. | |||||
| CVE-2026-50090 | 1 Aqara | 1 Cloud Oauth Authorization Endpoint | 2026-07-09 | N/A | 9.3 CRITICAL |
| The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching, which is an instance of "CWE-1289: Improper Validation of Unsafe Equivalence in Input" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3 Critical). | |||||
| CVE-2021-25298 | 1 Nagios | 1 Nagios Xi | 2026-07-09 | 9.0 HIGH | 8.8 HIGH |
| Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | |||||
| CVE-2021-25297 | 1 Nagios | 1 Nagios Xi | 2026-07-09 | 9.0 HIGH | 8.8 HIGH |
| Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | |||||
| CVE-2021-25296 | 1 Nagios | 1 Nagios Xi | 2026-07-09 | 9.0 HIGH | 8.8 HIGH |
| Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | |||||
| CVE-2024-23055 | 1 Plone | 1 Plone Docker Official Image | 2026-07-09 | N/A | 6.1 MEDIUM |
| An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers. | |||||
| CVE-2024-22902 | 1 Vinchin | 1 Vinchin Backup And Recovery | 2026-07-09 | N/A | 9.8 CRITICAL |
| Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. | |||||
| CVE-2024-22901 | 1 Vinchin | 1 Vinchin Backup And Recovery | 2026-07-09 | N/A | 9.8 CRITICAL |
| Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials. | |||||
| CVE-2023-47327 | 1 Silverpeas | 1 Silverpeas | 2026-07-09 | N/A | 4.3 MEDIUM |
| The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL. | |||||
| CVE-2023-47325 | 1 Silverpeas | 1 Silverpeas | 2026-07-09 | N/A | 5.4 MEDIUM |
| Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces. | |||||
| CVE-2023-47323 | 1 Silverpeas | 1 Silverpeas | 2026-07-09 | N/A | 7.5 HIGH |
| The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators. | |||||
| CVE-2023-47321 | 1 Silverpeas | 1 Silverpeas | 2026-07-09 | N/A | 4.9 MEDIUM |
| Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. | |||||
| CVE-2023-47320 | 1 Silverpeas | 1 Silverpeas | 2026-07-09 | N/A | 8.1 HIGH |
| Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below. | |||||
| CVE-2023-43336 | 1 Sangoma | 1 Freepbx | 2026-07-09 | N/A | 8.8 HIGH |
| Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101. | |||||
| CVE-2023-43141 | 1 Totolink | 4 A3700r, A3700r Firmware, N600r and 1 more | 2026-07-09 | N/A | 9.8 CRITICAL |
| TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control. | |||||