Total
422304 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-1457 | 1 Facturascripts | 1 Facturascripts | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account. | |||||
| CVE-2022-1456 | 1 Ays-pro | 1 Poll Maker | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed | |||||
| CVE-2022-1455 | 1 Callnowbutton | 1 Call Now Button | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled | |||||
| CVE-2022-1453 | 1 Carrcommunications | 1 Rsvpmaker | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5. | |||||
| CVE-2022-1452 | 1 Radare | 1 Radare2 | 2026-06-17 | 5.8 MEDIUM | 7.1 HIGH |
| Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html). | |||||
| CVE-2022-1451 | 1 Radare | 1 Radare2 | 2026-06-17 | 5.8 MEDIUM | 7.1 HIGH |
| Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html). | |||||
| CVE-2022-1445 | 1 Snipeitapp | 1 Snipe-it | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie. | |||||
| CVE-2022-1444 | 1 Radare | 1 Radare2 | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service. | |||||
| CVE-2022-1442 | 1 Wpmet | 1 Metform Elementor Contact Form Builder | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3. | |||||
| CVE-2022-1441 | 2 Debian, Gpac | 2 Debian Linux, Gpac | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow. | |||||
| CVE-2022-1440 | 1 Git-interface Project | 1 Git-interface | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker. | |||||
| CVE-2022-1439 | 1 Microweber | 1 Microweber | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction. | |||||
| CVE-2022-1438 | 1 Redhat | 1 Keycloak | 2026-06-17 | N/A | 6.4 MEDIUM |
| A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability. | |||||
| CVE-2022-1437 | 1 Radare | 1 Radare2 | 2026-06-17 | 5.8 MEDIUM | 7.1 HIGH |
| Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. | |||||
| CVE-2022-1436 | 1 Wptaskforce | 1 Track \& Trace | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks. | |||||
| CVE-2022-1435 | 1 Wptaskforce | 1 Track \& Trace | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. | |||||
| CVE-2022-1433 | 1 Gitlab | 1 Gitlab | 2026-06-17 | 4.3 MEDIUM | 2.6 LOW |
| An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute. | |||||
| CVE-2022-1432 | 1 Octoprint | 1 Octoprint | 2026-06-17 | 4.6 MEDIUM | 6.4 MEDIUM |
| Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. | |||||
| CVE-2022-1431 | 1 Gitlab | 1 Gitlab | 2026-06-17 | 5.0 MEDIUM | 4.3 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption. | |||||
| CVE-2022-1430 | 1 Octoprint | 1 Octoprint | 2026-06-17 | 5.1 MEDIUM | 7.5 HIGH |
| Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. | |||||