Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2024-58260 2025-10-02 HIGH 7.6 A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User…
CVE-2025-54293 2025-10-02 N/A 0.0 Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via…
CVE-2025-40992 2025-10-02 N/A 0.0 Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affecting to 'name' parameter via POST. This vulnerability could…
CVE-2025-40991 2025-10-02 N/A 0.0 Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via…
CVE-2025-40990 2025-10-02 N/A 0.0 Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description"…
CVE-2025-40989 2025-10-02 N/A 0.0 Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via…
CVE-2025-61735 2025-10-02 HIGH 7.3 Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin…
CVE-2025-61734 2025-10-02 HIGH 7.5 Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This…
CVE-2025-61733 2025-10-02 HIGH 7.5 Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version…
CVE-2025-54468 2025-10-02 MEDIUM 4.7 A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers…
CVE-2025-54292 2025-10-02 N/A 0.0 Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names…
CVE-2025-54291 2025-10-02 N/A 0.0 Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code…
CVE-2025-54290 2025-10-02 N/A 0.0 Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using…
CVE-2025-54289 2025-10-02 N/A 0.0 Privilege Escalation in operations API in Canonical LXD 6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via…
CVE-2025-54288 2025-10-02 N/A 0.0 Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers…
CVE-2025-54287 2025-10-02 N/A 0.0 Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via…
CVE-2025-54286 2025-10-02 N/A 0.0 Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted…
CVE-2025-40646 2025-10-02 N/A 0.0 Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing…
CVE-2025-40645 2025-10-02 N/A 0.0 Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using…
CVE-2025-9697 2025-10-02 CRITICAL 9.8 The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to…
CVE-2025-9587 2025-10-02 MEDIUM 6.5 The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action…
CVE-2025-61692 2025-10-02 HIGH 7.8 VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected…
CVE-2025-61691 2025-10-02 HIGH 7.8 VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
CVE-2025-61690 2025-10-02 HIGH 7.8 KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
CVE-2025-58777 2025-10-02 HIGH 7.8 VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the…
CVE-2025-58776 2025-10-02 HIGH 7.8 KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected…
CVE-2025-58775 2025-10-02 HIGH 7.8 KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
CVE-2025-11221 2025-10-02 HIGH 8.8 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not…
CVE-2025-11182 2025-10-02 MEDIUM 6.5 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All…
CVE-2025-11020 2025-10-02 HIGH 8.8 An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC…
CVE-2025-61588 2025-10-02 N/A 0.0 RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls…
CVE-2025-61583 2025-10-01 MEDIUM 4.3 TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the…
CVE-2025-61582 2025-10-01 HIGH 7.5 TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated…
CVE-2025-61587 2025-10-01 N/A 0.0 Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis…
CVE-2025-59951 2025-10-01 N/A 0.0 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1.5.0 and below, due to being…
CVE-2025-54811 2025-10-01 HIGH 7.1 OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends…
CVE-2025-23355 2025-10-01 MEDIUM 6.7 NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack. A successful exploit of this vulnerability may…
CVE-2025-23297 2025-10-01 HIGH 7.8 NVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attacker with local unprivileged access could modify files in the Frameview SDK…
CVE-2025-59538 2025-10-01 HIGH 7.5 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are…
CVE-2025-59537 2025-10-01 HIGH 7.5 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious…
CVE-2025-59531 2025-10-01 HIGH 7.5 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious…
CVE-2025-59337 2025-10-01 N/A 0.0 Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups,…
CVE-2025-59150 2025-10-01 HIGH 7.5 Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword…
CVE-2025-57389 2025-10-01 MEDIUM 5.4 A reflected cross-site scripted (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via…
CVE-2025-61855 2025-10-02 N/A 0.0 Rejected reason: Not used
CVE-2025-61854 2025-10-02 N/A 0.0 Rejected reason: Not used
CVE-2025-61853 2025-10-02 N/A 0.0 Rejected reason: Not used
CVE-2025-61852 2025-10-02 N/A 0.0 Rejected reason: Not used
CVE-2025-61851 2025-10-02 N/A 0.0 Rejected reason: Not used
CVE-2025-61850 2025-10-02 N/A 0.0 Rejected reason: Not used
« Anterior Página 120 de 3646 Siguiente »