Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,221

Export CSV
CVE-2025-47981

SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 41.1% KEV · Not listed
Vendors
Microsoft
Products
Windows Windows 10 Windows 10 1507 and 23 more
CVE-2025-49721

Windows Fast FAT File System Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows Windows 10 Windows 10 1507 and 24 more
CVE-2025-47987

Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Microsoft
Products
Windows Windows 10 Windows 10 1507 and 24 more
CVE-2025-57709

Qsync Central

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qsync Central Qsync Central
CVE-2025-52869

Qsync Central

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qsync Central Qsync Central
CVE-2025-52870

Qsync Central

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qsync Central Qsync Central
CVE-2025-52868

Qsync Central

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qsync Central Qsync Central
CVE-2025-48724

Qsync Central

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qsync Central Qsync Central
CVE-2025-48723

Qsync Central

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qsync Central Qsync Central
CVE-2025-27026

Improper Access Control Granularity impacting Infinera G42

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nokia
Products
G42 G42 Firmware
CVE-2024-4147

Insufficient Access Control in lunary-ai/lunary

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, only checking if the user has permissions to delete such resources without verifying if it belongs to the user's project or organization. As a result, users can remove prompts not owned by their organization or project, leading to legitimate users being unable to access the removed prompts and causing information inconsistencies.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Lunary Lunary-ai
Products
Lunary Lunary