Filtered by CWE-284
Filtered by vendor Subscriptions
Total 5037 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-7107 1 Code-projects 1 Invoice System In Laravel 2026-04-28 6.3 Medium
A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-43198 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 9.8 Critical
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access protected user data.
CVE-2025-43232 1 Apple 4 Macos, Macos Sequoia, Macos Sonoma and 1 more 2026-04-28 9.8 Critical
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to bypass certain Privacy preferences.
CVE-2025-43270 1 Apple 4 Macos, Sequoia, Sonoma and 1 more 2026-04-28 8.8 High
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may gain unauthorized access to Local Network.
CVE-2025-43371 1 Apple 1 Xcode 2026-04-28 8.2 High
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
CVE-2025-43340 1 Apple 1 Macos 2026-04-28 7.8 High
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox.
CVE-2025-24197 1 Apple 4 Macos, Macos Sequoia, Macos Sonoma and 1 more 2026-04-28 5.5 Medium
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access sensitive user data.
CVE-2025-43321 1 Apple 4 Macos, Macos Sequoia, Macos Sonoma and 1 more 2026-04-28 5.5 Medium
The issue was resolved by blocking unsigned services from launching on Intel Macs. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data.
CVE-2025-43208 1 Apple 1 Macos 2026-04-28 5.5 Medium
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to read sensitive location information.
CVE-2025-43285 1 Apple 1 Macos 2026-04-28 5.5 Medium
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data.
CVE-2025-43315 1 Apple 4 Macos, Macos Sequoia, Macos Sonoma and 1 more 2026-04-28 5.5 Medium
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access user-sensitive data.
CVE-2025-43207 1 Apple 1 Macos 2026-04-28 5.5 Medium
This issue was addressed with improved entitlements. This issue is fixed in macOS Tahoe 26. An app may be able to access user-sensitive data.
CVE-2025-31270 1 Apple 1 Macos 2026-04-28 5.5 Medium
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data.
CVE-2025-43319 1 Apple 1 Macos 2026-04-28 5.5 Medium
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data.
CVE-2026-1114 2 Lollms, Parisneo 2 Lollms, Lollms 2026-04-28 N/A
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attack to recover the secret key. Once the secret key is obtained, the attacker can forge administrative tokens by modifying the JWT payload and resigning it with the cracked secret. This enables unauthorized users to escalate privileges, impersonate the administrator, and gain access to restricted endpoints. The issue is resolved in version 2.2.0.
CVE-2025-43325 1 Apple 1 Macos 2026-04-28 5.5 Medium
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
CVE-2025-43305 1 Apple 1 Macos 2026-04-28 5.5 Medium
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to access private information.
CVE-2025-43294 1 Apple 1 Macos 2026-04-28 3.3 Low
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26, tvOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.
CVE-2025-43328 1 Apple 1 Macos 2026-04-28 3.3 Low
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
CVE-2026-35172 1 Distribution 1 Distribution 2026-04-28 7.5 High
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.