CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

BIG-IP httpd access control vulnerability

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE-420May 13, 2026
CVSS6.9v4.0EPSS0.228%PoCs0SignalsSTIX

Prosody mod_proxy65 Unprotected Alternate Channel

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.

CWE-420May 1, 2026
CVSS6.5v3.1EPSS0.204%PoCs0SignalsSTIX

LiteLLM has a sandbox escape in custom-code guardrail

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

CWE-420CWE-913CWE-94Apr 10, 2026
CVSS-v4.0EPSS6.5%PoCs2SignalsSTIX

OpenSSH Proxy-Mode Multiplexing Connection Confirmation Omission

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

CWE-420Apr 2, 2026
CVSS2.5v3.1EPSS0.13%PoCs0SignalsSTIX

Roundcube Webmail SVG feImage Information Disclosure

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

CWE-420Feb 9, 2026
CVSS4.3v3.1EPSS0.629%PoCs1SignalsSTIX

Beckhoff: Performing privileged operations and gaining administrator access

A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.

CWE-420Jan 27, 2026
CVSS7.8v3.1EPSS0.163%PoCs0SignalsSTIX

ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface

CWE-420Jan 5, 20261 related artifact
CVSS7.5v3.1EPSS1.36%PoCs6SignalsSTIX

BullWall Ransomware Containment hard-coded folder exclusions

BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings.

CWE-420Dec 18, 2025
CVSS8.7v4.0EPSS0.339%PoCs0SignalsSTIX

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.

CWE-420Nov 30, 2025
CVSS5.0v3.1EPSS0.22%PoCs0SignalsSTIX

Unauthenticated log access in Twonky Server

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

CWE-420Nov 19, 20251 related artifact
CVSS9.3v4.0EPSS32.9%PoCs2SignalsSTIX

The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the devi…

CWE-284CWE-420Oct 29, 2025
CVSS3.0v3.1EPSS0.354%PoCs0SignalsSTIX

Slack Nebula may accept arbitrary source IP addresses

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

CWE-420Oct 23, 2025
CVSS4.9v3.1EPSS0.203%PoCs0SignalsSTIX

figma-developer-mcp vulnerable to command injection in get_figma_data tool

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interface.

CWE-420CWE-77Oct 8, 2025
CVSS8.0v3.1EPSS7.42%PoCs0SignalsSTIX

An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a device on the local Lenovo XClarity Orchestrator (LXCO) network segment may be able to manipulate the local device to create an alternate communication channel which could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction,…

CWE-420Sep 11, 2025
CVSS8.7v4.0EPSS0.254%PoCs0SignalsSTIX

The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states …

CWE-420CWE-693Sep 8, 2025
CVSS7.4v3.1EPSS0.238%PoCs0SignalsSTIX

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

CWE-420Aug 3, 2025
CVSS8.9v3.1EPSS0.397%PoCs0SignalsSTIX

CrushFTP Unprotected Alternate Channel Vulnerability

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

CWE-420Jul 18, 20251 related artifact
CVSS9.0v3.1EPSS94.4%PoCs6SignalsSTIX

In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any p…

CWE-420Jun 23, 2025
CVSS9.9v3.1EPSS0.479%PoCs0SignalsSTIX

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do no…

CWE-420Jun 23, 2025
CVSS2.7v3.1EPSS0.183%PoCs0SignalsSTIX

IBM Personal Communications command execution

IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029.

CWE-119CWE-420Apr 8, 2025
CVSS8.8v3.1EPSS0.138%PoCs0SignalsSTIX

Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

CWE-420Feb 14, 2025
CVSS4.7v3.1EPSS0.171%PoCs0SignalsSTIX

A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIRT-2023-34408) This vulnerability has been assigned a (CVE)ID:CVE-2023-52718

CWE-420Dec 28, 2024
CVSS6.4v3.1EPSS0.153%PoCs0SignalsSTIX

Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIRT-2023-76605) This vulnerability has been assigned a (CVE)ID:CVE-2023-7266

CWE-420Dec 28, 2024
CVSS7.5v3.1EPSS0.274%PoCs0SignalsSTIX

codechecker vulnerable to authentication bypass when using specifically crafted URLs

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability. This issue affects CodeChecker: through 6.24.1.

CWE-288CWE-420Nov 6, 20241 related artifact
CVSS-v4.0EPSS39.1%PoCs0SignalsSTIX

Vulnerable juju introspection abstract UNIX domain socket

Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.

CWE-420Oct 2, 2024
CVSS-v4.0EPSS0.212%PoCs0SignalsSTIX