Total
420947 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-35856 | 1 Nintendo | 1 Mario Kart Wii | 2026-06-17 | N/A | 9.8 CRITICAL |
| A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machine via a crafted packet. | |||||
| CVE-2023-35855 | 1 Valvesoftware | 1 Counter-strike | 2026-06-17 | N/A | 9.8 CRITICAL |
| A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable. | |||||
| CVE-2023-35854 | 1 Zohocorp | 1 Manageengine Adselfservice Plus | 2026-06-17 | N/A | 9.8 CRITICAL |
| Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability." | |||||
| CVE-2023-35853 | 1 Oisf | 1 Suricata | 2026-06-17 | N/A | 9.8 CRITICAL |
| In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section. | |||||
| CVE-2023-35852 | 1 Oisf | 1 Suricata | 2026-06-17 | N/A | 7.5 HIGH |
| In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolute or relative directory traversal, and lead to write access to a local filesystem. This is addressed in 6.0.13 by requiring allow-absolute-filenames and allow-write (in the datasets rules configuration section) if an installation requires traversal/writing in this situation. | |||||
| CVE-2023-35851 | 1 Sun.net | 1 Wmpro | 2026-06-17 | N/A | 7.5 HIGH |
| SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database. | |||||
| CVE-2023-35850 | 1 Sun.net | 1 Wmpro | 2026-06-17 | N/A | 7.2 HIGH |
| SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service. | |||||
| CVE-2023-35849 | 1 Virtualsquare | 1 Picotcp | 2026-06-17 | N/A | 7.5 HIGH |
| VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet. | |||||
| CVE-2023-35848 | 1 Virtualsquare | 1 Picotcp | 2026-06-17 | N/A | 7.5 HIGH |
| VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member. | |||||
| CVE-2023-35847 | 1 Virtualsquare | 1 Picotcp | 2026-06-17 | N/A | 7.5 HIGH |
| VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero). | |||||
| CVE-2023-35846 | 1 Virtualsquare | 1 Picotcp | 2026-06-17 | N/A | 7.5 HIGH |
| VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before performing port filtering. | |||||
| CVE-2023-35845 | 2 Anaconda, Linux | 2 Anaconda3, Linux Kernel | 2026-06-17 | N/A | 4.7 MEDIUM |
| Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as world-writable on Linux, ignoring umask, even when these files are installed as root. Miniconda is also affected. | |||||
| CVE-2023-35844 | 1 Lightdash | 1 Lightdash | 2026-06-17 | N/A | 7.5 HIGH |
| packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used. | |||||
| CVE-2023-35843 | 1 Nocodb | 1 Nocodb | 2026-06-17 | N/A | 7.5 HIGH |
| NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information. | |||||
| CVE-2023-35841 | 1 Phoenixtech | 1 Winflash | 2026-06-17 | N/A | 7.8 HIGH |
| Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0. | |||||
| CVE-2023-35840 | 1 Std42 | 1 Elfinder | 2026-06-17 | N/A | 6.5 MEDIUM |
| _joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector. | |||||
| CVE-2023-35839 | 1 Solon | 1 Solon | 2026-06-17 | N/A | 9.8 CRITICAL |
| A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload. | |||||
| CVE-2023-35838 | 2 Microsoft, Wireguard | 2 Windows, Wireguard | 2026-06-17 | N/A | 5.7 MEDIUM |
| The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard. | |||||
| CVE-2023-35837 | 1 Solax | 2 Pocket Wifi 3, Pocket Wifi 3 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an unauthenticated WiFi AP. The administrative password for the web interface has a default password, equal to the registration ID of the device. This same registration ID is used as the WiFi SSID name. No routine is in place to force a change to this password on first use or bring its default state to the attention of the user. Once authenticated, an attacker can reconfigure the device or upload new firmware, both of which can lead to Denial of Service, code execution, or Escalation of Privileges. | |||||
| CVE-2023-35836 | 1 Solax | 2 Pocket Wifi 3, Pocket Wifi 3 Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup and reconfiguration. Upon success, the attacker is able to further infiltrate the target's Wi-Fi networks. | |||||