Export limit exceeded: 344982 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (344982 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-25243 | 1 Fasttube | 1 Fasttube | 2026-04-16 | 6.2 Medium |
| FastTube 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 1900 characters into the search bar and trigger a crash when the search operation is executed. | ||||
| CVE-2018-25244 | 1 Ecosearch | 1 Eco Search | 2026-04-16 | 6.2 Medium |
| Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar and trigger a crash by initiating a search operation. | ||||
| CVE-2018-25245 | 1 7tik | 1 7 Tik | 2026-04-16 | 7.5 High |
| 7 Tik 1.0.1.0 contains a denial of service vulnerability that allows attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 7700 characters into the search bar to trigger an application crash. | ||||
| CVE-2018-25246 | 1 Wikipedia | 1 Wikipedia | 2026-04-16 | 7.5 High |
| Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash. | ||||
| CVE-2018-25251 | 1 Sourceforge | 1 Snes9k 0.0.9z | 2026-04-16 | 8.4 High |
| Snes9K 0.0.9z contains a buffer overflow vulnerability in the Netplay Socket Port Number field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Socket Port Number field via the Netplay Options menu to achieve code execution through SEH chain exploitation. | ||||
| CVE-2018-25255 | 1 10-strike | 1 Strike Lanstate | 2026-04-16 | 8.4 High |
| 10-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling that allows local attackers to execute arbitrary code by crafting malicious LSM map files. Attackers can create a specially formatted LSM file with a payload in the ObjCaption parameter that overflows the buffer, overwrites the SEH chain, and executes shellcode when the file is opened in the application. | ||||
| CVE-2019-25656 | 1 R-project | 1 R | 2026-04-16 | 8.4 High |
| R i386 3.5.0 contains a local buffer overflow vulnerability in the GUI Preferences dialog that allows local attackers to trigger a structured exception handler (SEH) overwrite by supplying malicious input. Attackers can craft a payload string in the 'Language for menus and messages' field to overwrite SEH records and achieve code execution with calculator or arbitrary shellcode. | ||||
| CVE-2019-25658 | 1 Amac | 1 Mac Address Change | 2026-04-16 | 5.5 Medium |
| a-Mac Address Change 5.4 contains a local buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input to registration form fields. Attackers can paste 212 bytes of data into the 'Your Name', 'Your Company', or 'Register Code' fields and click the Register button to trigger a denial of service crash. | ||||
| CVE-2019-25659 | 1 Xlinesoft | 1 Asprunner Professional | 2026-04-16 | 6.2 Medium |
| ASPRunner Professional 6.0.766 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by supplying an excessively long project name. Attackers can paste 180 or more characters into the Project name field during project creation to trigger an application crash. | ||||
| CVE-2019-25661 | 1 Lizardsystems | 1 Remote Process Explorer | 2026-04-16 | 6.2 Medium |
| Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to the added computer, overwriting the SEH chain and corrupting exception handlers. | ||||
| CVE-2019-25671 | 1 Va Max | 1 Va Max | 2026-04-16 | 8.8 High |
| VA MAX 8.3.4 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the mtu_eth0 parameter. Attackers can send POST requests to the changeip.php endpoint with malicious payload in the mtu_eth0 field to execute commands as the apache user. | ||||
| CVE-2019-25673 | 1 Unisharp | 1 Laravel-filemanager | 2026-04-16 | 8.8 High |
| UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute arbitrary code by accessing the uploaded file through the working directory path. | ||||
| CVE-2026-31153 | 1 Bynder | 1 Bynder | 2026-04-16 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in Bynder v0.1.394 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||||
| CVE-2016-20056 | 1 Spy-emergency | 1 Spy Emergency | 2026-04-16 | 7.8 High |
| Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services that allows local attackers to escalate privileges by inserting malicious executables. Attackers can place executable files in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges. | ||||
| CVE-2016-20061 | 1 Sheedantivirus | 1 Sheed Antivirus | 2026-04-16 | 7.8 High |
| sheed AntiVirus 2.3 contains an unquoted service path vulnerability in the ShavProt service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can insert a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges. | ||||
| CVE-2018-25241 | 1 Microsoft | 1 Vpn Browser+ | 2026-04-16 | 7.5 High |
| VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of characters into the search bar to trigger an unhandled exception that terminates the application. | ||||
| CVE-2026-22682 | 1 Hkuds | 1 Openharness | 2026-04-16 | 7.1 High |
| OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope. Attackers can exploit the path parameter not being passed to the PermissionChecker in read_file, write_file, edit_file, and notebook_edit tools to bypass deny rules and access sensitive files such as configuration files, credentials, and SSH material, or create and overwrite files in restricted host paths in full_auto mode. | ||||
| CVE-2026-27744 | 2 Centreon, Spip | 2 Open Tickets, Tickets | 2026-04-16 | 9.8 Critical |
| The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server. | ||||
| CVE-2026-26104 | 2 Freedesktop, Redhat | 3 Udisks, Enterprise Linux, Enterprise Linux Eus | 2026-04-16 | 5.5 Medium |
| A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes. | ||||
| CVE-2026-3118 | 1 Redhat | 2 Developer Hub, Rhdh | 2026-04-16 | 6.5 Medium |
| A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform. | ||||