Total
424635 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-22856 | 1 Blogengine | 1 Blogengine.net | 2026-06-17 | N/A | 8.5 HIGH |
| A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file. | |||||
| CVE-2023-22855 | 1 Kardex | 1 Kardex Control Center | 2026-06-17 | N/A | 9.8 CRITICAL |
| Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote files on SMB shares. If one provides a file with the extension .t4, it is rendered with the .NET templating engine mono/t4, which can execute code. | |||||
| CVE-2023-22854 | 1 Mitel | 1 Micontact Center Business | 2026-06-17 | N/A | 7.5 HIGH |
| The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information. | |||||
| CVE-2023-22853 | 1 Tiki | 1 Tiki | 2026-06-17 | N/A | 8.8 HIGH |
| Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval. | |||||
| CVE-2023-22852 | 1 Tiki | 1 Tiki | 2026-06-17 | N/A | 6.5 MEDIUM |
| Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php. | |||||
| CVE-2023-22851 | 1 Tiki | 1 Tiki | 2026-06-17 | N/A | 7.2 HIGH |
| Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call. | |||||
| CVE-2023-22850 | 1 Tiki | 1 Tiki | 2026-06-17 | N/A | 8.8 HIGH |
| Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call. | |||||
| CVE-2023-22849 | 1 Apache | 1 Sling Cms | 2026-06-17 | N/A | 6.1 MEDIUM |
| An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling App CMS >= 1.1.6 | |||||
| CVE-2023-22848 | 1 Intel | 1 Thunderbolt Dch Driver | 2026-06-17 | N/A | 5.5 MEDIUM |
| Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access. | |||||
| CVE-2023-22847 | 1 Sraoss | 1 Pg Ivm | 2026-06-17 | N/A | 4.3 MEDIUM |
| Information disclosure vulnerability exists in pg_ivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View (IMMV) created by pg_ivm may reflect rows with Row-Level Security that the owner of the IMMV should not have access to. As a result, information in tables protected by Row-Level Security may be retrieved by a user who is not authorized to access it. | |||||
| CVE-2023-22846 | 1 Datakit | 1 Crosscadware | 2026-06-17 | N/A | 3.3 LOW |
| Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information. | |||||
| CVE-2023-22845 | 1 Openimageio | 1 Openimageio | 2026-06-17 | N/A | 7.5 HIGH |
| An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. | |||||
| CVE-2023-22844 | 1 Milesight | 1 Milesightvpn | 2026-06-17 | N/A | 7.3 HIGH |
| An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability. | |||||
| CVE-2023-22843 | 1 Nozominetworks | 2 Cmc, Guardian | 2026-06-17 | N/A | 6.4 MEDIUM |
| An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Via stored Cross-Site Scripting (XSS), an attacker may be able to perform unauthorized actions on behalf of legitimate users and/or gather sensitive information. JavaScript injection was possible in the contents for Yara rules, while limited HTML injection has been proven for packet and STYX rules. | |||||
| CVE-2023-22842 | 1 F5 | 12 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 9 more | 2026-06-17 | N/A | 7.5 HIGH |
| On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2023-22841 | 1 Intel | 2 C621a, Server Firmware Update Utility | 2026-06-17 | N/A | 6.7 MEDIUM |
| Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems Based on Intel(R) 621A Chipset before version 16.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||
| CVE-2023-22840 | 2 Fedoraproject, Intel | 2 Fedora, Onevpl Gpu Runtime | 2026-06-17 | N/A | 3.3 LOW |
| Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable denial of service via local access. | |||||
| CVE-2023-22838 | 1 Ec-cube | 1 Ec-cube | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script. | |||||
| CVE-2023-22836 | 1 Guardiansoft | 1 Guardian | 2026-06-17 | N/A | 3.5 LOW |
| In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the rest of the stack’s tenants. | |||||
| CVE-2023-22835 | 1 Palantir | 2 Foundry Frontend, Foundry Issues | 2026-06-17 | N/A | 7.7 HIGH |
| A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants. This defect was resolved with the release of Foundry Issues 2.510.0 and Foundry Frontend 6.228.0. | |||||