Total
424195 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-26630 | 1 Jellycms | 1 Jellycms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php. | |||||
| CVE-2022-26629 | 3 Linux, Microsoft, Splus | 3 Linux Kernel, Windows, Soroushplus | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privileges, which allows a malicious attacker bypass the lock screen function. | |||||
| CVE-2022-26628 | 1 Matrimony Project | 1 Matrimony | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter. | |||||
| CVE-2022-26627 | 1 Online Project Time Management System Project | 1 Online Project Time Management System | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file. | |||||
| CVE-2022-26624 | 1 Ecommerce Codeigniter Bootstrap Project | 1 Ecommerce Codeigniter Bootstrap | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/add_product.php. | |||||
| CVE-2022-26619 | 1 Halo | 1 Halo | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. | |||||
| CVE-2022-26616 | 1 Public Knowledge Project | 1 Open Journal Systems | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers. | |||||
| CVE-2022-26615 | 1 College Website Content Management System Project | 1 College Website Content Management System | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields. | |||||
| CVE-2022-26613 | 1 Php-cms Project | 1 Php-cms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php. | |||||
| CVE-2022-26612 | 2 Apache, Microsoft | 2 Hadoop, Windows | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3 | |||||
| CVE-2022-26605 | 1 Dascomsoft | 1 Eziosuite | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality. | |||||
| CVE-2022-26592 | 1 Sass-lang | 1 Libsass | 2026-06-17 | N/A | 8.8 HIGH |
| Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. | |||||
| CVE-2022-26591 | 1 Fantec | 2 Mwid25-ds, Mwid25-ds Firmware | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request. | |||||
| CVE-2022-26589 | 1 Pluck-cms | 1 Pluck | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. | |||||
| CVE-2022-26588 | 1 Icehrm | 1 Icehrm | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI. | |||||
| CVE-2022-26585 | 1 Mingsoft | 1 Mcms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. | |||||
| CVE-2022-26582 | 1 Paxtechnology | 2 A930, Paydroid | 2026-06-17 | N/A | 7.8 HIGH |
| PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attacker must have shell access to the device in order to exploit this vulnerability. | |||||
| CVE-2022-26581 | 1 Paxtechnology | 2 A930, Paydroid | 2026-06-17 | N/A | 6.8 MEDIUM |
| PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an unauthorized attacker to perform privileged actions through the execution of specific binaries listed in ADB daemon. The attacker must have physical USB access to the device in order to exploit this vulnerability. | |||||
| CVE-2022-26580 | 1 Paxtechnology | 2 A930, Paydroid | 2026-06-17 | N/A | 6.8 MEDIUM |
| PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in the ADB daemon shell service. The attacker must have physical USB access to the device in order to exploit this vulnerability. | |||||
| CVE-2022-26579 | 1 Paxtechnology | 2 A930, Paydroid | 2026-06-17 | N/A | 6.0 MEDIUM |
| PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacker must have shell access to the device and gain root privileges in order to exploit this vulnerability. | |||||