Total
409224 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-52084 | 1 Wintercms | 1 Winter | 2026-06-17 | N/A | 2.0 LOW |
| Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4. | |||||
| CVE-2023-52083 | 1 Wintercms | 1 Winter | 2026-06-17 | N/A | 2.0 LOW |
| Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4. | |||||
| CVE-2023-52082 | 1 Lycheeorg | 1 Lychee | 2026-06-17 | N/A | 8.8 HIGH |
| Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging. | |||||
| CVE-2023-52081 | 1 Ewen-lbh | 1 Firefox Css | 2026-06-17 | N/A | 5.3 MEDIUM |
| ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (﹍), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds. | |||||
| CVE-2023-52080 | 2026-06-17 | N/A | 7.7 HIGH | ||
| IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. Attackers with access to local NVRAM variables can exploit this by modifying these variables on SPI Flash, resulting in memory data being tampered with. When critical data in memory data is tampered with,a crash may occur. | |||||
| CVE-2023-52079 | 1 Kriszyp | 1 Msgpackr | 2026-06-17 | N/A | 6.8 MEDIUM |
| msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue. | |||||
| CVE-2023-52077 | 1 Nexryai | 1 Nexkey | 2026-06-17 | N/A | 8.9 HIGH |
| Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5. | |||||
| CVE-2023-52076 | 1 Mate-desktop | 1 Atril | 2026-06-17 | N/A | 8.5 HIGH |
| Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability. | |||||
| CVE-2023-52075 | 1 Revanced | 1 Revanced | 2026-06-17 | N/A | 7.5 HIGH |
| ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching. | |||||
| CVE-2023-52074 | 1 Flycms Project | 1 Flycms | 2026-06-17 | N/A | 8.8 HIGH |
| FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte. | |||||
| CVE-2023-52073 | 1 Flycms Project | 1 Flycms | 2026-06-17 | N/A | 8.8 HIGH |
| FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte. | |||||
| CVE-2023-52072 | 1 Flycms Project | 1 Flycms | 2026-06-17 | N/A | 8.8 HIGH |
| FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte. | |||||
| CVE-2023-52069 | 1 Kodcloud | 1 Kodbox | 2026-06-17 | N/A | 5.4 MEDIUM |
| kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter. | |||||
| CVE-2023-52068 | 1 Kodcloud | 1 Kodbox | 2026-06-17 | N/A | 6.1 MEDIUM |
| kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs. | |||||
| CVE-2023-52066 | 2026-06-17 | N/A | 7.2 HIGH | ||
| http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter. | |||||
| CVE-2023-52064 | 1 Wuzhicms | 1 Wuzhicms | 2026-06-17 | N/A | 9.8 CRITICAL |
| Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php. | |||||
| CVE-2023-52060 | 1 Gestsup | 1 Gestsup | 2026-06-17 | N/A | 4.3 MEDIUM |
| A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request. | |||||
| CVE-2023-52059 | 1 Gestsup | 1 Gestsup | 2026-06-17 | N/A | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field. | |||||
| CVE-2023-52048 | 1 Ruoyi | 1 Ruoyi | 2026-06-17 | N/A | 4.7 MEDIUM |
| RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/. | |||||
| CVE-2023-52047 | 1 Dedecms | 1 Dedecms | 2026-06-17 | N/A | 8.8 HIGH |
| Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager. | |||||