Total
421097 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-33460 | 3 Debian, Fedoraproject, Yajl Project | 3 Debian Linux, Fedora, Yajl | 2026-06-17 | N/A | 6.5 MEDIUM |
| There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. | |||||
| CVE-2023-33457 | 1 Sogou | 1 C\+\+ Workflow | 2026-06-17 | N/A | 8.8 HIGH |
| In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash. | |||||
| CVE-2023-33443 | 1 Besder | 2 Bes--6024pb-i50h1, Videoplaytool | 2026-06-17 | N/A | 9.8 CRITICAL |
| Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a crafted payload sent to the desired endpoints. | |||||
| CVE-2023-33440 | 1 Faculty Evaluation System Project | 1 Faculty Evaluation System | 2026-06-17 | N/A | 7.2 HIGH |
| Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user. | |||||
| CVE-2023-33439 | 1 Faculty Evaluation System Project | 1 Faculty Evaluation System | 2026-06-17 | N/A | 7.2 HIGH |
| Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=. | |||||
| CVE-2023-33410 | 1 Minical | 1 Minical | 2026-06-17 | N/A | 8.8 HIGH |
| Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file. | |||||
| CVE-2023-33409 | 1 Minical | 1 Minical | 2026-06-17 | N/A | 6.5 MEDIUM |
| Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php. | |||||
| CVE-2023-33408 | 1 Minical | 1 Minical | 2026-06-17 | N/A | 5.4 MEDIUM |
| Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validation in the application's user input handling in the security_helper.php file. | |||||
| CVE-2023-33405 | 1 Blogengine | 1 Blogengine.net | 2026-06-17 | N/A | 6.1 MEDIUM |
| Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. | |||||
| CVE-2023-33404 | 1 Blogengine | 1 Blogengine.net | 2026-06-17 | N/A | 9.8 CRITICAL |
| An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code. | |||||
| CVE-2023-33394 | 1 Skycaiji | 1 Skycaiji | 2026-06-17 | N/A | 5.4 MEDIUM |
| skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend XSS by deploying malicious JSON data. | |||||
| CVE-2023-33387 | 1 Datev | 1 Eg Personal-management System Comfort\/comfort Plus | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link. | |||||
| CVE-2023-33386 | 1 Marsctf Project | 1 Marsctf | 2026-06-17 | N/A | 9.8 CRITICAL |
| MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background. | |||||
| CVE-2023-33383 | 1 Shelly | 2 Pro 4pm, Pro 4pm Firmware | 2026-06-17 | N/A | 5.3 MEDIUM |
| Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload. | |||||
| CVE-2023-33379 | 1 Connectedio | 2 Er2000t-vz-cat1, Er2000t-vz-cat1 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices. | |||||
| CVE-2023-33378 | 1 Connectedio | 1 Connected Io | 2026-06-17 | N/A | 9.8 CRITICAL |
| Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices. | |||||
| CVE-2023-33377 | 1 Connectedio | 1 Connected Io | 2026-06-17 | N/A | 9.8 CRITICAL |
| Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices. | |||||
| CVE-2023-33376 | 1 Connectedio | 1 Connected Io | 2026-06-17 | N/A | 9.8 CRITICAL |
| Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices. | |||||
| CVE-2023-33375 | 1 Connectedio | 1 Connected Io | 2026-06-17 | N/A | 9.8 CRITICAL |
| Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices. | |||||
| CVE-2023-33374 | 1 Connectedio | 1 Connected Io | 2026-06-17 | N/A | 9.8 CRITICAL |
| Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution. | |||||