VYPR

CVEs

410,213 total · page 1948 of 8,205

AllCriticalHighKEV
  • CVE-2025-13706HigDec 23, 2025
    Tencent
    Patrickstar
    risk 0.44cvss 7.8epss 0.01

    Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent PatrickStar. User interaction is required to exploit this…

  • CVE-2025-13703HigDec 23, 2025
    Vipre
    Advanced Security
    risk 0.51cvss 7.8epss 0.00

    VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security for PC. An attacker must first obtain the ability to execute…

  • CVE-2025-13700HigDec 23, 2025
    Dreamfactorysoftware
    Dreamfactory Core
    risk 0.40cvss 7.2epss 0.02

    DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of DreamFactory. Authentication is required to exploit this vulnerability. The specific flaw exists…

  • CVE-2025-13699HigDec 23, 2025
    MariaDB
    MariaDB
    risk 0.46cvss 7.0epss 0.01

    MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability…

  • CVE-2025-13698MedDec 23, 2025
    DECISO
    OPNsense
    risk 0.22cvss 4.5epss 0.01

    Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Deciso OPNsense. Authentication is required to exploit this…

  • CVE-2025-12840HigDec 23, 2025
    Openexr
    Openexr
    risk 0.51cvss 7.8epss 0.00

    Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is…

  • CVE-2025-12839HigDec 23, 2025
    Openexr
    Openexr
    risk 0.51cvss 7.8epss 0.00

    Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is…

  • CVE-2025-12838HigDec 23, 2025
    risk 0.47cvss 7.3epss 0.00

    MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSP360 Free Backup. An attacker must first obtain the ability to execute low-privileged code on the target…

  • CVE-2025-12495HigDec 23, 2025
    Openexr
    Openexr
    risk 0.51cvss 7.8epss 0.00

    Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is…

  • CVE-2025-12491HigDec 23, 2025
    Senstar
    Symphony
    risk 0.49cvss 7.5epss 0.01

    Senstar Symphony FetchStoredLicense Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Senstar Symphony. Authentication is not required to exploit this vulnerability. The specific flaw…

  • CVE-2025-15045CriDec 23, 2025
    Tenda
    WH450
    risk 0.64cvss 9.8epss 0.01

    A flaw has been found in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/Natlimit of the component HTTP Request Handler. This manipulation of the argument page causes stack-based buffer overflow. It is possible to initiate the attack…

  • CVE-2025-15044CriDec 23, 2025
    Tenda
    WH450
    risk 0.64cvss 9.8epss 0.01

    A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be…

  • CVE-2025-14936HigDec 23, 2025
    Unidata
    Netcdf
    risk 0.51cvss 7.8epss 0.00

    NSF Unidata NetCDF-C Attribute Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability…

  • CVE-2025-14935HigDec 23, 2025
    Unidata
    Netcdf
    risk 0.51cvss 7.8epss 0.00

    NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability…

  • CVE-2025-14934HigDec 23, 2025
    Unidata
    Netcdf
    risk 0.51cvss 7.8epss 0.00

    NSF Unidata NetCDF-C Variable Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability…

  • CVE-2025-14933HigDec 23, 2025
    Unidata
    Netcdf
    risk 0.51cvss 7.8epss 0.00

    NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the…

  • CVE-2025-14932HigDec 23, 2025
    Unidata
    Netcdf
    risk 0.51cvss 7.8epss 0.00

    NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in…

  • CVE-2025-14931CriDec 23, 2025
    risk 0.65cvss 10.0epss 0.01

    Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face smolagents. Authentication is not required to…

  • CVE-2025-14930HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this…

  • CVE-2025-14929HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required…

  • CVE-2025-14928HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this…

  • CVE-2025-14927HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this…

  • CVE-2025-14926HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this…

  • CVE-2025-14925HigDec 23, 2025
    Huggingface
    Accelerate
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is required to exploit this vulnerability in…

  • CVE-2025-14924HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit…

  • CVE-2025-14922HigDec 23, 2025
    Huggingface
    Diffusers CogView4
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Diffusers. User interaction is required to exploit this…

  • CVE-2025-14921HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to…

  • CVE-2025-14920HigDec 23, 2025
    Huggingface
    Transformers
    risk 0.51cvss 7.8epss 0.00

    Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit…

  • CVE-2025-11419HigDec 23, 2025
    Keycloak
    Keycloak
    risk 0.49cvss 7.5epss 0.01

    A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.

  • CVE-2025-65354CriDec 23, 2025
    PuneethReddyHC
    Event Management
    risk 0.64cvss 9.8epss 0.01

    Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_name POST parameter. Crafted payloads can alter query logic and disclose database contents. Exploitation may result in sensitive data…

  • CVE-2023-53982HigDec 23, 2025
    PMB
    PMB
    risk 0.49cvss 7.5epss 0.01

    PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional…

  • CVE-2021-47739HigDec 23, 2025
    Epic Games
    Easy Anti-Cheat
    risk 0.55cvss 8.4epss 0.00

    Epic Games Easy Anti-Cheat 4.0 contains an unquoted service path vulnerability that allows local non-privileged users to execute arbitrary code with elevated system privileges. Attackers can exploit the service configuration by inserting malicious code in the system root path…

  • CVE-2021-47738MedDec 23, 2025
    CSZ CMS
    cszcms
    risk 0.35cvss 5.4epss 0.00

    CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message…

  • CVE-2021-47737MedDec 23, 2025
    CSZ CMS
    cszcms
    risk 0.35cvss 5.4epss 0.00

    CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering…

  • CVE-2021-47736HigDec 23, 2025
    Cmsimple Xh
    Cmsimple Xh
    risk 0.47cvss 7.2epss 0.01

    CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file…

  • CVE-2021-47735HigDec 23, 2025
    Cmsimple
    Cmsimple
    risk 0.57cvss 8.8epss 0.01

    CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the…

  • CVE-2021-47734HigDec 23, 2025
    Cmsimple
    Cmsimple
    risk 0.51cvss 7.8epss 0.01

    CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code…

  • CVE-2021-47733MedDec 23, 2025
    Cmsimple
    Cmsimple
    risk 0.40cvss 6.1epss 0.00

    CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact…

  • CVE-2021-47732MedDec 23, 2025
    Cmsimple
    Cmsimple
    risk 0.40cvss 6.1epss 0.00

    CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling…

  • CVE-2021-47722LowDec 23, 2025
    Zucchetti
    Axess CLOKI Access Control
    risk 0.23cvss 3.5epss 0.00

    Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings without user interaction. Attackers can craft malicious web pages with hidden forms to disable or modify access control…

  • CVE-2021-47721HigDec 23, 2025
    Orangescrum
    Orangescrum
    risk 0.57cvss 8.8epss 0.00

    Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to…

  • CVE-2021-47720HigDec 23, 2025
    Orangescrum
    Orangescrum
    risk 0.46cvss 7.1epss 0.00

    Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters. Attackers can inject malicious SQL code into parameters like old_project_id, project_id, uuid, and uniqid…

  • CVE-2021-47716MedDec 23, 2025
    Orangescrum
    Orangescrum
    risk 0.35cvss 5.4epss 0.00

    Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CS_message', and 'name' to execute arbitrary JavaScript code…

  • CVE-2025-25364HigDec 23, 2025
    Connectify
    Speedify
    risk 0.55cvss 8.4epss 0.01

    A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary commands with root-level privileges.

  • CVE-2025-10863Dec 23, 2025
    risk 0.00cvss —epss —

    Rejected reason: This CVE id was assigned but later discarded.

  • CVE-2025-51511CriDec 23, 2025
    Cadmium CMS
    Cadmium CMS
    risk 0.64cvss 9.8epss 0.00

    Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.

  • CVE-2025-65713MedDec 23, 2025
    Jpettitt
    Home Assistant
    risk 0.19cvss 4.0epss 0.00

    Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.

  • CVE-2025-65410MedDec 23, 2025
    GNU
    unrtf
    risk 0.40cvss 6.2epss 0.00

    A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.

  • CVE-2025-33224CriDec 23, 2025
    Nvidia
    Isaac Launchable
    risk 0.64cvss 9.8epss 0.01

    NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data…

  • CVE-2025-33223CriDec 23, 2025
    Nvidia
    Isaac Launchable
    risk 0.64cvss 9.8epss 0.01

    NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data…