Total
36333 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-37412 | 1 Ibm | 1 Aspera Faspex | 2026-06-17 | N/A | 4.4 MEDIUM |
| IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls. | |||||
| CVE-2023-37410 | 1 Ibm | 1 Person Communications | 2026-06-17 | N/A | 8.4 HIGH |
| IBM Personal Communications 14.05, 14.06, and 15.0.0 could allow a local user to escalate their privileges to the SYSTEM user due to overly permissive access controls. IBM X-Force ID: 260138. | |||||
| CVE-2023-37404 | 1 Ibm | 1 Observability With Instana | 2026-06-17 | N/A | 6.4 MEDIUM |
| IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack. IBM X-Force ID: 259789. | |||||
| CVE-2023-37379 | 1 Apache | 1 Airflow | 2026-06-17 | N/A | 8.1 HIGH |
| Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface. | |||||
| CVE-2023-37378 | 1 Nullsoft | 1 Nullsoft Scriptable Install System | 2026-06-17 | N/A | 5.3 MEDIUM |
| Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory. | |||||
| CVE-2023-37369 | 2 Debian, Qt | 2 Debian Linux, Qt | 2026-06-17 | N/A | 7.5 HIGH |
| In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. | |||||
| CVE-2023-37305 | 1 Mediawiki | 1 Mediawiki | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces. | |||||
| CVE-2023-37303 | 1 Mediawiki | 1 Mediawiki | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message. | |||||
| CVE-2023-37301 | 1 Mediawiki | 1 Mediawiki | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur. | |||||
| CVE-2023-37267 | 1 Umbraco | 1 Umbraco Cms | 2026-06-17 | N/A | 7.5 HIGH |
| Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1. | |||||
| CVE-2023-37266 | 1 Icewhale | 1 Casaos | 2026-06-17 | N/A | 9.8 CRITICAL |
| CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly. | |||||
| CVE-2023-37263 | 1 Strapi | 1 Strapi | 2026-06-17 | N/A | 6.8 MEDIUM |
| Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue. | |||||
| CVE-2023-37249 | 1 Infoblox | 1 Nios | 2026-06-17 | N/A | 8.8 HIGH |
| Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access. | |||||
| CVE-2023-37239 | 1 Huawei | 2 Emui, Harmonyos | 2026-06-17 | N/A | 7.5 HIGH |
| Format string vulnerability in the distributed file system. Attackers who bypass the selinux permission can exploit this vulnerability to crash the program. | |||||
| CVE-2023-37238 | 1 Huawei | 2 Emui, Harmonyos | 2026-06-17 | N/A | 5.3 MEDIUM |
| Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features. | |||||
| CVE-2023-37234 | 1 Loftware | 1 Spectrum | 2026-06-17 | N/A | 9.8 CRITICAL |
| Loftware Spectrum through 4.6 has unprotected JMX Registry. | |||||
| CVE-2023-37232 | 1 Loftware | 1 Spectrum | 2026-06-17 | N/A | 7.5 HIGH |
| Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor. | |||||
| CVE-2023-37216 | 1 Anasystem | 2 Sensmini M4, Sensmini M4 Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device | |||||
| CVE-2023-37210 | 1 Mozilla | 1 Firefox | 2026-06-17 | N/A | 6.5 MEDIUM |
| A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115. | |||||
| CVE-2023-37208 | 2 Debian, Mozilla | 4 Debian Linux, Firefox, Firefox Esr and 1 more | 2026-06-17 | N/A | 7.8 HIGH |
| When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. | |||||