Export limit exceeded: 372303 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372303 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-23568 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 5.3 Medium |
| HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software could allow an attacker to determine which vulnerabilities are present in the software, particularly if an outdated software version is in use with published vulnerabilities. | ||||
| CVE-2024-23573 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 3.7 Low |
| HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL3.0 and TLS1.0. This can also be considered a type of man-in-the-middle attack. | ||||
| CVE-2024-23575 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 5.3 Medium |
| HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more focused attack. | ||||
| CVE-2024-23577 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 4.3 Medium |
| HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations. | ||||
| CVE-2024-23569 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 4.3 Medium |
| HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header | ||||
| CVE-2024-23570 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 4.3 Medium |
| HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site. The attacker can then launch a Clickjacking attack, which may lead to Phishing, Cross-Site Request Forgery, sensitive information leakage and more. | ||||
| CVE-2024-23572 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 4.2 Medium |
| HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function. | ||||
| CVE-2026-66369 | 1 Mz-automation | 1 Libiec61850 | 2026-07-31 | 6.5 Medium |
| The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap out-of-bounds read. On affected platforms, this condition reliably terminates the subscriber process and causes a denial-of-service. | ||||
| CVE-2026-63033 | 1 Mz-automation | 1 Lib60870 | 2026-07-31 | 6.5 Medium |
| A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer. | ||||
| CVE-2026-58039 | 2026-07-31 | N/A | ||
| A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | ||||
| CVE-2025-59866 | 1 Hcltech | 3 Dfmpro For Catia, Dfxanalytics, Dfxserver | 2026-07-31 | 3.3 Low |
| The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary. | ||||
| CVE-2025-69933 | 1 Codeastro | 1 Membership Management System | 2026-07-30 | N/A |
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. | ||||
| CVE-2026-61526 | 1 Adonisjs | 1 Http-server | 2026-07-30 | 6.1 Medium |
| AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0. | ||||
| CVE-2026-62246 | 1 Clastix | 1 Kamaji | 2026-07-30 | 8.5 High |
| Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge. | ||||
| CVE-2026-63362 | 2026-07-30 | 5.9 Medium | ||
| An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet. | ||||
| CVE-2025-51684 | 1 Clevertap | 1 Web Sdk | 2026-07-30 | N/A |
| CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site. | ||||
| CVE-2026-67207 | 1 Wolfcms | 1 Wolfcms | 2026-07-30 | 8.8 High |
| Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges. | ||||
| CVE-2026-65835 | 1 Projectcapsule | 1 Capsule | 2026-07-30 | 6.6 Medium |
| Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8. | ||||
| CVE-2026-18064 | 2026-07-30 | 7.5 High | ||
| An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset. | ||||
| CVE-2025-69931 | 1 Codeastro | 1 Membership Management System | 2026-07-30 | N/A |
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1. | ||||