Export limit exceeded: 18352 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18352 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-53419 | 2026-04-15 | 7.8 High | ||
| Delta Electronics COMMGR has Code Injection vulnerability. | ||||
| CVE-2025-53371 | 2026-04-15 | 9.1 Critical | ||
| DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and file_get_contents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. This allows for DOS by causing the server to read large files. SSRF is also possible if there are internal unprotected APIs that can be accessed using HTTP POST requests, which could also possibly lead to RCE. This vulnerability is fixed in commit 1f20d850cbcce5b15951c7c6127b87b927a5415e. | ||||
| CVE-2025-52491 | 1 Akamai | 1 Cloudtest | 2026-04-15 | 5.8 Medium |
| Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. | ||||
| CVE-2025-52477 | 2026-04-15 | 8.6 High | ||
| Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging. | ||||
| CVE-2025-52362 | 1 Phproxy | 1 Phproxy | 2026-04-15 | 9.1 Critical |
| Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL | ||||
| CVE-2025-20075 | 2026-04-15 | N/A | ||
| Server-side request forgery (SSRF) vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executing arbitrary backend Web API requests could potentially lead to rebooting the services. | ||||
| CVE-2024-45858 | 1 Guardrailsai | 1 Guardrails | 2026-04-15 | 7.8 High |
| An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine. | ||||
| CVE-2023-39333 | 2 Nodejs, Redhat | 2 Nodejs, Enterprise Linux | 2026-04-15 | 5.3 Medium |
| Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option. | ||||
| CVE-2024-56803 | 2026-04-15 | N/A | ||
| Ghostty is a cross-platform terminal emulator. Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. This attack requires an attacker to send malicious escape sequences followed by convincing the user to physically press the "enter" key. Fixed in Ghostty v1.0.1. | ||||
| CVE-2023-41816 | 2026-04-15 | 5 Medium | ||
| An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attacker to write to a local database. | ||||
| CVE-2023-41817 | 2026-04-15 | 2.8 Low | ||
| An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information. | ||||
| CVE-2023-41818 | 2026-04-15 | 5 Medium | ||
| An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application that could allow a local attacker to read system logs. | ||||
| CVE-2023-41820 | 1 Motorola | 1 Ready For | 2026-04-15 | 5 Medium |
| An implicit intent vulnerability was reported in the Motorola Ready For application that could allow a local attacker to read information about connected Bluetooth audio devices. | ||||
| CVE-2023-41821 | 2026-04-15 | 5 Medium | ||
| A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information. | ||||
| CVE-2023-41822 | 2026-04-15 | 4.8 Medium | ||
| An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands. | ||||
| CVE-2023-41823 | 2026-04-15 | 4.4 Medium | ||
| An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activities. | ||||
| CVE-2023-41824 | 2026-04-15 | 2.8 Low | ||
| An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data. | ||||
| CVE-2023-41826 | 2026-04-15 | 5.1 Medium | ||
| A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or interact with non-exported software components without permission. | ||||
| CVE-2023-41827 | 2026-04-15 | 5.1 Medium | ||
| An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI. | ||||
| CVE-2023-41828 | 2026-04-15 | 4.4 Medium | ||
| An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provider. | ||||