Total
420475 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-39010 | 1 Boofcv | 1 Boofcv | 2026-06-17 | N/A | 9.8 CRITICAL |
| BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file. | |||||
| CVE-2023-39008 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 9.8 CRITICAL |
| A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands. | |||||
| CVE-2023-39007 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 9.6 CRITICAL |
| /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php. | |||||
| CVE-2023-39006 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization. | |||||
| CVE-2023-39005 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 7.5 HIGH |
| Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. | |||||
| CVE-2023-39002 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |||||
| CVE-2023-39001 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 9.8 CRITICAL |
| A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file. | |||||
| CVE-2023-39000 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path. | |||||
| CVE-2023-38999 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 6.5 MEDIUM |
| A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. | |||||
| CVE-2023-38998 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 6.1 MEDIUM |
| An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL. | |||||
| CVE-2023-38997 | 1 Opnsense | 1 Opnsense | 2026-06-17 | N/A | 7.2 HIGH |
| A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive. | |||||
| CVE-2023-38996 | 1 Douran | 1 Dsgate | 2026-06-17 | N/A | 6.7 MEDIUM |
| An issue in all versions of Douran DSGate allows a local authenticated privileged attacker to execute arbitrary code via the debug command. | |||||
| CVE-2023-38995 | 1 Schuhfried | 1 Schuhfried | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command. | |||||
| CVE-2023-38994 | 1 Univention | 1 Univention Corporate Server | 2026-06-17 | N/A | 7.9 HIGH |
| The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users. | |||||
| CVE-2023-38992 | 1 Jeecg | 1 Jeecg Boot | 2026-06-17 | N/A | 9.8 CRITICAL |
| jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData. | |||||
| CVE-2023-38991 | 1 Jeesite | 1 Jeesite | 2026-06-17 | N/A | 5.4 MEDIUM |
| An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator. | |||||
| CVE-2023-38990 | 1 Jeesite | 1 Jeesite | 2026-06-17 | N/A | 4.3 MEDIUM |
| An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator. | |||||
| CVE-2023-38989 | 1 Jeesite | 1 Jeesite | 2026-06-17 | N/A | 4.3 MEDIUM |
| An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information. | |||||
| CVE-2023-38988 | 1 Jeesite | 1 Jeesite | 2026-06-17 | N/A | 4.3 MEDIUM |
| An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators. | |||||
| CVE-2023-38976 | 1 Weaviate | 1 Weaviate | 2026-06-17 | N/A | 7.5 HIGH |
| An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function. | |||||