Total
417561 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-62300 | 2026-09-29 | N/A | 5.9 MEDIUM | ||
| HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior. | |||||
| CVE-2020-37244 | 2026-09-29 | N/A | 8.2 HIGH | ||
| Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques. | |||||
| CVE-2025-62299 | 2026-09-29 | N/A | 6.6 MEDIUM | ||
| HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges. | |||||
| CVE-2025-52640 | 2026-09-29 | N/A | 4.7 MEDIUM | ||
| HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions. | |||||
| CVE-2020-37235 | 2026-09-29 | N/A | 6.4 MEDIUM | ||
| WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page. | |||||
| CVE-2020-37243 | 2026-09-29 | N/A | 8.2 HIGH | ||
| Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables. | |||||
| CVE-2020-37239 | 2026-09-29 | N/A | 9.8 CRITICAL | ||
| libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_free() twice on the same pointer without triggering detection, as libc's malloc metadata overwrites babl's signature field upon freeing, enabling potential memory corruption and code execution. | |||||
| CVE-2020-37237 | 2026-09-29 | N/A | 6.4 MEDIUM | ||
| Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner management interface. Attackers with admin credentials can inject XSS payloads in the Description field of the Add banner functionality, which execute for all website visitors when they access the home page. | |||||
| CVE-2025-15671 | 2026-09-29 | N/A | 5.4 MEDIUM | ||
| The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request. | |||||
| CVE-2025-11729 | 2026-09-29 | N/A | 4.3 MEDIUM | ||
| The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content. | |||||
| CVE-2025-36398 | 1 Ibm | 4 Ds8900f, Ds8900f Firmware, Ds8a00 and 1 more | 2026-09-29 | N/A | 5.4 MEDIUM |
| IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename. | |||||
| CVE-2022-42479 | 2026-09-29 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in TemplateHouse Soledad allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Soledad: from n/a through 8.2.5. | |||||
| CVE-2025-7639 | 2026-09-29 | N/A | 7.1 HIGH | ||
| The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps". | |||||
| CVE-2020-37238 | 2026-09-29 | N/A | 6.4 MEDIUM | ||
| CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files containing embedded JavaScript to the file manager, which executes when other authenticated users access the uploaded file, enabling cookie theft and session hijacking. | |||||
| CVE-2025-36254 | 1 Ibm | 4 Ds8900f, Ds8900f Firmware, Ds8a00 and 1 more | 2026-09-29 | N/A | 7.4 HIGH |
| IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service. | |||||
| CVE-2020-37234 | 2026-09-29 | N/A | 6.2 MEDIUM | ||
| Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition. | |||||
| CVE-2025-10308 | 2026-09-29 | N/A | 4.3 MEDIUM | ||
| The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |||||
| CVE-2025-9210 | 2026-09-29 | N/A | 8.1 HIGH | ||
| Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs | |||||
| CVE-2025-62307 | 2026-09-29 | N/A | 5.4 MEDIUM | ||
| HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing. | |||||
| CVE-2016-20085 | 2026-09-29 | N/A | 7.8 HIGH | ||
| Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem privileges. | |||||