Total
425359 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-3435 | 3 Debian, Fedoraproject, Linux | 3 Debian Linux, Fedora, Linux Kernel | 2026-06-17 | N/A | 4.3 MEDIUM |
| A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability. | |||||
| CVE-2022-3434 | 1 Web-based Student Clearance System Project | 1 Web-based Student Clearance System | 2026-06-17 | N/A | 3.5 LOW |
| A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been rated as problematic. Affected by this issue is the function prepare of the file /Admin/add-student.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210356. | |||||
| CVE-2022-3433 | 1 Haskell | 1 Aeson | 2026-06-17 | N/A | 6.5 MEDIUM |
| The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service. | |||||
| CVE-2022-3432 | 1 Lenovo | 2 Ideapad Y700-14isk, Ideapad Y700-14isk Firmware | 2026-06-17 | N/A | 6.7 MEDIUM |
| A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. | |||||
| CVE-2022-3431 | 1 Lenovo | 50 D330-10igl, D330-10igl Firmware, Ideapad 5 Pro-16ach6 and 47 more | 2026-06-17 | N/A | 6.7 MEDIUM |
| A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. | |||||
| CVE-2022-3430 | 1 Lenovo | 88 D330-10igl, D330-10igl Firmware, Ideapad 5 Pro 16arh7 and 85 more | 2026-06-17 | N/A | 6.7 MEDIUM |
| A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. | |||||
| CVE-2022-3429 | 1 Lenovo | 6 G263dns, G263dns Firmware, Gm265dn and 3 more | 2026-06-17 | N/A | 6.5 MEDIUM |
| A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering a denial of service that causes a display error and prevents the printer from functioning properly. | |||||
| CVE-2022-3427 | 1 Dwbooster | 1 Corner Ad | 2026-06-17 | N/A | 8.8 HIGH |
| The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible for unauthenticated attackers to trigger the deletion of ads via forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |||||
| CVE-2022-3426 | 1 Advanced Wp Columns Project | 1 Advanced Wp Columns | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-3425 | 1 Sumo | 1 Google Analyticator | 2026-06-17 | N/A | 7.2 HIGH |
| The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. | |||||
| CVE-2022-3424 | 2 Linux, Redhat | 2 Linux Kernel, Enterprise Linux | 2026-06-17 | N/A | 7.8 HIGH |
| A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system. | |||||
| CVE-2022-3423 | 1 Nocodb | 1 Nocodb | 2026-06-17 | N/A | 7.3 HIGH |
| Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. | |||||
| CVE-2022-3422 | 1 Tooljet | 1 Tooljet | 2026-06-17 | N/A | 7.5 HIGH |
| Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass | |||||
| CVE-2022-3421 | 2 Apple, Google | 2 Macos, Drive | 2026-06-17 | N/A | 5.6 MEDIUM |
| An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that directory with execute permissions and set its setuid bit. Since the attacker owns the directory, the attacker can replace the binary with a symlink, causing the installer to set the setuid bit on the symlink. When the symlink is executed, it will run with root permissions. We recommend upgrading past version 64.0 | |||||
| CVE-2022-3420 | 1 Official Integration For Billingo Project | 1 Official Integration For Billingo | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2022-3419 | 1 Addify | 1 Automatic User Roles Switcher | 2026-06-17 | N/A | 6.5 MEDIUM |
| The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator | |||||
| CVE-2022-3418 | 1 Soflyy | 1 Wp All Import | 2026-06-17 | N/A | 7.2 HIGH |
| The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files | |||||
| CVE-2022-3417 | 1 Bravenewcode | 1 Wptouch | 2026-06-17 | N/A | 8.8 HIGH |
| The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog. | |||||
| CVE-2022-3416 | 1 Bravenewcode | 1 Wptouch | 2026-06-17 | N/A | 7.2 HIGH |
| The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) | |||||
| CVE-2022-3415 | 1 Bluecoral | 1 Chat Bubble | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message | |||||