Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 136

Export CSV
CVE-2025-48068

Information exposure in Next.js dev server due to lack of origin verification

Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Vercel
Products
Next.js
CVE-2025-36116

IBM Db2 Mirror for i cross-site websocket hijacking

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Mirror For I
CVE-2022-48279

mod_security: incorrect parsing of HTTP multipart requests leads to web application firewall bypass

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Debian Owasp Redhat and 1 more
Products
Debian Linux Modsecurity Jboss Core Services and 1 more
CVE-2019-15606

nodejs: HTTP header values do not have trailing optional whitespace trimmed

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1 · 9.8 Critical EPSS 20.0% KEV · Not listed
Vendors
Debian Nodejs Opensuse and 2 more
Products
Debian Linux Node.js Leap and 6 more
CVE-2015-5186

Audit: log terminal emulator escape sequences handling

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.

CVSS 3.0 · 5.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Linux Audit Project
Products
Linux Audit
CVE-2017-10906

fluentd: Escape sequence injection in filter_parser.rb:filter_stream can lead to arbitrary command execution when processing logs

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

CVSS 3.0 · 9.8 Critical EPSS 4.6% KEV · Not listed
Vendors
Fluentd Redhat
Products
Fluentd Openstack Openstack-optools
CVE-2017-1000361

opendaylight: Port-Status packets sent to Controller create exceptions

DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.

CVSS 3.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Opendaylight
Products
Opendaylight
CVE-2017-1000360

opendaylight: console exception in odl-mdsal-xsql feature

StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.

CVSS 3.0 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Opendaylight
Products
Opendaylight
CVE-2017-1000359

opendaylight: DOS by odl-mdsal-xsql feature

Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.

CVSS 3.0 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Opendaylight
Products
Opendaylight
CVE-2017-12629

Solr: Code execution via entity expansion

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

CVSS 3.1 · 9.8 Critical EPSS 92.5% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Solr Ubuntu Linux Debian Linux and 6 more
CVE-2017-0902

rubygems: DNS hijacking vulnerability

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0 · 8.1 High EPSS 4.8% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2017-0901

rubygems: Arbitrary file overwrite due to incorrect validation of specification name

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

CVSS 3.0 · 7.5 High EPSS 29.4% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2015-5234

icedtea-web: unexpected permanent authorization of unsigned applets

IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

CVSS 2.0 · 6.8 Medium EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Opensuse Enterprise Linux and 5 more
CVE-2016-1248

vim: Lack of validation of values for few options results in code exection

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

CVSS 3.0 · 7.8 High EPSS 25.3% KEV · Not listed
Vendors
Debian Redhat Vim
Products
Debian Linux Enterprise Linux Vim
CVE-2015-3245

libuser: does not filter newline characters in the GECOS field

Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.

CVSS 2.0 · 2.1 Low EPSS 5.4% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libuser
CVE-2014-2972

exim: local code execution via string expansion

expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Exim
Products
Exim
CVE-2012-2694

rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.

CVSS 2.0 · 4.3 Medium EPSS 3.9% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more