Total
36333 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-15330 | 1 Webp Express Project | 1 Webp Express | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. | |||||
| CVE-2019-15325 | 1 Galliumos | 1 Galliumos | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not. | |||||
| CVE-2019-15322 | 1 Wpmadeasy | 1 Shortcode Factory | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion. | |||||
| CVE-2019-15312 | 1 Linkplay | 1 Linkplay | 2026-06-17 | 9.3 HIGH | 8.8 HIGH |
| An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to be vulnerable to DNS rebinding. Combined with one of the many /httpapi.asp endpoint command-execution security issues, the DNS rebinding attack could allow an attacker to compromise the victim device from the Internet. | |||||
| CVE-2019-15293 | 1 Acdsee | 1 Photo Studio | 2026-06-17 | 4.6 MEDIUM | 7.8 HIGH |
| An issue was discovered in ACDSee Photo Studio Standard 22.1 Build 1159. There is a User Mode Write AV starting at IDE_ACDStd!IEP_ShowPlugInDialog+0x000000000023d060. | |||||
| CVE-2019-15237 | 2 Fedoraproject, Roundcube | 2 Fedora, Webmail | 2026-06-17 | 4.3 MEDIUM | 7.4 HIGH |
| Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks. | |||||
| CVE-2019-15137 | 1 Eprosima | 1 Fast-rtps | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network. | |||||
| CVE-2019-15111 | 1 Wp Front End Profile Project | 1 Wp Front End Profile | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue. | |||||
| CVE-2019-15088 | 1 Prise | 1 Adas | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication. | |||||
| CVE-2019-15080 | 1 Morph Project | 1 Morph | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack. | |||||
| CVE-2019-15079 | 1 Eai Project | 1 Eai | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This vulnerability could be used by an attacker to acquire EAI tokens for free. | |||||
| CVE-2019-15078 | 1 Xbornid | 1 Xbornid | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo (wrong case: XBornID versus XBORNID) that allows an attacker to change the owner of the contract and obtain cryptocurrency for free. | |||||
| CVE-2019-15069 | 1 Gigastone | 2 Smart Battery A4, Smart Battery A4 Firmware | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege. | |||||
| CVE-2019-15067 | 1 Gigastone | 2 Smart Battery A2-25de, Smart Battery A2-25de Firmware | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page. | |||||
| CVE-2019-15066 | 1 Hinet | 2 Gpon, Gpon Firmware | 2026-06-17 | 10.0 HIGH | 10.0 CRITICAL |
| An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 6998. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | |||||
| CVE-2019-15065 | 1 Hinet | 2 Gpon, Gpon Firmware | 2026-06-17 | 5.0 MEDIUM | 9.3 CRITICAL |
| A service which is hosted on port 6998 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3.0 Base score 9.3. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). | |||||
| CVE-2019-15038 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1. | |||||
| CVE-2019-15035 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1. | |||||
| CVE-2019-15028 | 1 Joomla | 1 Joomla\! | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms. | |||||
| CVE-2019-15024 | 1 Clickhouse | 1 Clickhouse | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to write to arbitrary path on filesystem. | |||||