Export limit exceeded: 396026 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (2058 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-58288 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 5.5 Medium |
| Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58292 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 3.3 Low |
| Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58287 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 7.8 High |
| Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2025-58437 | 1 Coder | 1 Coder | 2025-10-17 | 8.1 High |
| Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2. | ||||
| CVE-2025-54086 | 1 Absolute | 1 Secure Access | 2025-10-16 | 3.3 Low |
| CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attack requirements, the privileges required are low and no user interaction is required. Impact to confidentiality is low, there is no impact to integrity or availability. | ||||
| CVE-2025-46014 | 1 Honor | 1 Pc Manager | 2025-10-15 | 8.8 High |
| Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation. | ||||
| CVE-2025-29504 | 1 Huang-yk | 1 Student-manage | 2025-10-15 | 7.8 High |
| Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification. | ||||
| CVE-2024-36538 | 1 Chaos-mesh | 2 Chaos-mesh, Chaos Mesh | 2025-10-14 | 8.8 High |
| Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. | ||||
| CVE-2025-0797 | 1 Escanav | 1 Escan Anti-virus | 2025-10-09 | 3.3 Low |
| A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the file /var/Microworld/ of the component Quarantine Handler. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2024-13188 | 1 Escanav | 1 Escan Anti-virus | 2025-10-09 | 5.3 Medium |
| A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. Affected by this issue is some unknown functionality of the file /opt/MicroWorld/var/ of the component Installation Handler. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-8181 | 1 Totolink | 4 N600r, N600r Firmware, X2000r and 1 more | 2025-10-09 | 7.2 High |
| A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely. | ||||
| CVE-2024-52551 | 3 Jenkins, Jenkins Project, Redhat | 3 Pipeline\, Jenkins Pipeline Declaratrive Plugin, Ocp Tools | 2025-10-08 | 8 High |
| Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved. | ||||
| CVE-2024-54745 | 1 Wavlink | 2 Wn701ae, Wn701ae Firmware | 2025-10-03 | 9.8 Critical |
| WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. | ||||
| CVE-2024-54747 | 1 Wavlink | 2 Wn531p3, Wn531p3 Firmware | 2025-10-03 | 9.8 Critical |
| WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. | ||||
| CVE-2024-55398 | 1 4cstrategies | 1 Exonaut | 2025-10-01 | 6.5 Medium |
| 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions. | ||||
| CVE-2025-29365 | 1 Spimsimulator | 1 Spim | 2025-10-01 | 9.8 Critical |
| spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL. | ||||
| CVE-2024-46465 | 2 Microsoft, Primx | 2 Windows, Cryhod | 2025-10-01 | 7.8 High |
| By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of CRYHOD has to be modified to prevent this vulnerability. | ||||
| CVE-2024-48533 | 2 Esoft, Esoftplanner | 2 Planner, Esoft Planner | 2025-10-01 | 5.3 Medium |
| A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumerate valid user e-mail accounts. | ||||
| CVE-2024-40514 | 1 Themesbrand | 1 Chatvia | 2025-09-30 | 4.6 Medium |
| Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions. | ||||
| CVE-2025-55111 | 2 Bmc, Linux | 3 Control-m/agent, Control-m\/agent, Linux Kernel | 2025-09-29 | 5.5 Medium |
| Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating to SSL files, keystore and policies. An attacker with local access to the system running the Agent can access these files. | ||||