Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12614 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-10252 1 Seat 1 Queue Ticket Kiosk 2025-09-12 3.1 Low
A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation causes deserialization. The attack can only be done within the local network. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-55444 1 Vishalmathur 1 Online Artwork And Fine Arts Project 2025-09-11 9.8 Critical
A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution.
CVE-2025-10164 2025-09-11 7.3 High
A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The manipulation of the argument serialized_named_tensors results in deserialization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-30151 1 Shopware 1 Shopware 2025-09-10 7.5 High
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
CVE-2025-20032 1 Intel 7 Proset\/wireless Wifi, Wi-fi 6 Ax101, Wi-fi 6 Ax201 and 4 more 2025-09-10 7.9 High
Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow a privileged user to potentially enable denial of service via local access.
CVE-2025-29955 1 Microsoft 3 Windows 11 24h2, Windows Server 2022 23h2, Windows Server 2025 2025-09-10 6.2 Medium
Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally.
CVE-2025-29968 1 Microsoft 6 Windows Server 2008, Windows Server 2012, Windows Server 2016 and 3 more 2025-09-10 6.5 Medium
Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized attacker to deny service over a network.
CVE-2025-21370 1 Microsoft 3 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 2025-09-10 7.8 High
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVE-2025-21230 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-09-10 7.5 High
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21344 1 Microsoft 1 Sharepoint Server 2025-09-10 7.8 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-21284 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-09-10 5.5 Medium
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21280 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-09-10 5.5 Medium
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21235 1 Microsoft 8 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 5 more 2025-09-10 7.8 High
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
CVE-2025-21234 1 Microsoft 8 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 5 more 2025-09-10 7.8 High
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
CVE-2025-57810 1 Parall 1 Jspdf 2025-09-09 7.5 High
jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.
CVE-2024-43115 1 Apache 1 Dolphinscheduler 2025-09-09 8.8 High
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.
CVE-2024-37777 1 Zoneland 1 O2oa 2025-09-09 8.8 High
O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.
CVE-2022-20356 1 Google 1 Android 2025-09-08 4 Medium
In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-215003903
CVE-2021-37150 3 Apache, Debian, Fedoraproject 3 Traffic Server, Debian Linux, Fedora 2025-09-08 4.2 Medium
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
CVE-2025-55173 1 Vercel 1 Next.js 2025-09-08 4.3 Medium
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.