Explore CVE records

HighPublished 30 Apr 2026, 23:35 WIB

CVE-2025-51846

CryptPad unbounded WebSocket frame flood

CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.

Excerpt language: en.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 May 2026, 00:15 WIB

Official record

HighPublished 30 Apr 2026, 23:09 WIB

CVE-2022-50992

Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet

Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CritPublished 30 Apr 2026, 23:08 WIB

CVE-2022-50993

Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet

Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PH…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

CritPublished 30 Apr 2026, 23:08 WIB

CVE-2025-71284

Synway SMG Gateway Management Software OS Command Injection via radius_address

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 May 2026, 01:06 WIB

Official record

HighPublished 30 Apr 2026, 22:25 WIB

CVE-2025-14543

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated23 Sep 2026, 00:49 WIB

Official record

HighPublished 30 Apr 2026, 22:07 WIB

CVE-2026-5174

Improper Access Control Vulnerability in Progress MOVEit Automation

Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Excerpt language: en.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated01 May 2026, 22:24 WIB

Official record

CritPublished 30 Apr 2026, 22:06 WIB

CVE-2026-4670

Improper Authentication vulnerability in Progress MOVEit Automation

Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 May 2026, 10:55 WIB

Official record

MedPublished 30 Apr 2026, 21:53 WIB

CVE-2026-7500

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated26 Jun 2026, 13:46 WIB

Official record

HighPublished 30 Apr 2026, 20:28 WIB

CVE-2026-2892

Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie

The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 May 2026, 23:38 WIB

Official record

MedPublished 30 Apr 2026, 20:18 WIB

CVE-2026-7163

Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure

A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated07 Sep 2026, 19:05 WIB

Official record

UnscoredPublished 30 Apr 2026, 20:16 WIB

CVE-2026-7246

[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 03:50 WIB

Official record

HighPublished 30 Apr 2026, 19:48 WIB

CVE-2026-7402

Improper Rate Limiting in MeWare Software's PDKS

Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc. PDKS allows Flooding. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:42 WIB

Official record

HighPublished 30 Apr 2026, 19:39 WIB

CVE-2025-14576

Possible QML code injection in VectorImage component

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated29 Jul 2026, 15:59 WIB

Official record

HighPublished 30 Apr 2026, 19:39 WIB

CVE-2026-7399

IDOR in MeWare Software's PDKS

Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc. PDKS allows Privilege Abuse. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:43 WIB

Official record

MedPublished 30 Apr 2026, 19:34 WIB

CVE-2026-7382

Information Disclosure in MeWare Software's PDKS

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. PDKS allows Excavation. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:44 WIB

Official record

HighPublished 30 Apr 2026, 19:11 WIB

CVE-2024-13971

Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Excerpt language: en.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated18 May 2026, 05:18 WIB

Official record

UnscoredPublished 30 Apr 2026, 18:49 WIB

CVE-2026-5080

Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely

Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated01 May 2026, 01:29 WIB

Official record

HighPublished 30 Apr 2026, 18:47 WIB

CVE-2026-31693

cifs: some missing initializations on replay

In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:56 WIB

Official record

MedPublished 30 Apr 2026, 18:24 WIB

CVE-2026-1493

Cross-Site Scripting in LEX Baza Dokumentów

LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely processes the parameter on the client side, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser. An attacker with ability to set a cookie can perform a more severe attack, so we …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 20:04 WIB

Official record

HighPublished 30 Apr 2026, 18:05 WIB

CVE-2026-41882

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

Excerpt language: en.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated30 Apr 2026, 20:05 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage