Export limit exceeded: 44027 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (44027 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-21067 | 1 Samsung | 2 Mobile Devices, Notes | 2025-10-20 | 4 Medium |
| Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | ||||
| CVE-2025-21068 | 1 Samsung | 2 Mobile Devices, Notes | 2025-10-20 | 4 Medium |
| Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | ||||
| CVE-2025-21069 | 1 Samsung | 2 Mobile Devices, Notes | 2025-10-20 | 4 Medium |
| Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | ||||
| CVE-2025-21066 | 1 Samsung | 2 Mobile Devices, Notes | 2025-10-20 | 4 Medium |
| Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | ||||
| CVE-2025-58300 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 6.2 Medium |
| Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58297 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 5.9 Medium |
| Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58298 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 7.3 High |
| Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58301 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 6.2 Medium |
| Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58295 | 1 Huawei | 1 Harmonyos | 2025-10-20 | 5.9 Medium |
| Buffer overflow vulnerability in the development framework module. Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-54269 | 3 Adobe, Apple, Microsoft | 3 Animate, Macos, Windows | 2025-10-20 | 5.5 Medium |
| Animate versions 23.0.13, 24.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2025-54278 | 3 Adobe, Apple, Microsoft | 3 Bridge, Macos, Windows | 2025-10-20 | 5.5 Medium |
| Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2025-56676 | 1 Titansystems | 1 Zender | 2025-10-18 | 5.4 Medium |
| TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure. | ||||
| CVE-2025-45143 | 1 Devrafalko | 1 String-math | 2025-10-18 | 7 High |
| string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input. | ||||
| CVE-2025-59942 | 1 Filecoin | 1 Go-f3 | 2025-10-18 | 7.5 High |
| go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7. | ||||
| CVE-2025-56301 | 1 Chipsalliance | 1 Rocket-chip | 2025-10-17 | 7.5 High |
| An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29) allowing attackers to corrupt exception handling and privilege state transitions via a flawed interaction between exception handling and MRET return mechanisms in the CSR logic when an exception is triggered during MRET execution. The Control and Status Register (CSR) logic has a flawed interaction between exception handling and exception return (MRET) mechanisms which can cause faulty trap behavior. When the MRET instruction is executed in machine mode without being in an exception state, an Instruction Access Fault may be triggered. This results in both the exception handling logic and the exception return logic activating simultaneously, leading to conflicting updates to the control and status registers. | ||||
| CVE-2025-49458 | 1 Zoom | 8 Meeting Software Development Kit, Rooms, Rooms Controller and 5 more | 2025-10-17 | 6.5 Medium |
| Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access. | ||||
| CVE-2025-57350 | 1 Keyangxiang | 1 Csvtojson | 2025-10-17 | 8.6 High |
| The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file. | ||||
| CVE-2025-57330 | 1 Web3js | 1 Web3-core-subscriptions | 2025-10-17 | 7.5 High |
| The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject function of web3-core-subscriptions version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. | ||||
| CVE-2025-57347 | 1 Tbo47 | 1 Dagre-d3-es | 2025-10-17 | 9.8 Critical |
| A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., "__proto__"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure. | ||||
| CVE-2025-57348 | 1 Node-cube | 1 Node-cube | 2025-10-17 | 6.5 Medium |
| The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inject properties into the prototype of built-in objects. This issue, categorized under CWE-1321, arises from improper validation of user-supplied input in the package's resource initialization process. Successful exploitation may lead to denial of service or arbitrary code execution in affected environments. The vulnerability affects versions up to and including 5.0.0-beta.19, and no official fix has been released to date. | ||||