All CVEs — page 535 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection, allowing unauthenticated attackers to inject a PHP Object if specific conditions are met.
The flaw allows unauthenticated attackers to escalate privileges to Administrator by exploiting a chained vulnerability in the Meta Box AIO plugin for WordPress.
A vulnerability in the Gigatech PDV5701 1.0.31_240305_112640 WebSocket Service allows for missing authentication, enabling remote attackers to exploit it.
The flaw allows SQL injection via manipulation of the operator argument in Yonyou U8cloud 5.x's OpenAPI module, enabling remote code execution.
The flaw is a SQL injection vulnerability in Yonyou KSOA 9.0 due to improper argument handling in search_list.jsp, allowing remote attackers to execute arbitrary SQL commands. This matters because it can lead to data theft or corruption.
The flaw allows unauthenticated attackers to craft a malicious link that can exfiltrate sensitive information from an authenticated user's session in SAP Fiori Launchpad.
The flaw allows for os command injection through manipulation of the argument command in OctoPrint's Command API, enabling remote code execution.
The vulnerability allows path traversal through manipulation of the filename argument in OctoPrint's File Download API, enabling unauthorized access to files.
The vulnerability allows for cross-site scripting due to improper input handling in the Name argument of the /jobgroup/insert function, enabling remote attackers to inject malicious scripts.
The vulnerability in Moore Threads MTT S80 Driver Package 340.150 allows for improper privilege management, enabling local attackers to exploit it for high impact consequences.
The flaw allows attackers to trigger GPU memory exhaustion by submitting multiple completion requests, leading to orphaned KV cache blocks and preventing legitimate requests from executing.
The flaw allows attackers to allocate unbounded memory by supplying arbitrary tp_size values, potentially leading to a denial of service via kernel OOM-kill.
The vulnerability allows attackers to send rejected prefill requests that create ownerless transfer placeholders, leading to resource exhaustion and delayed processing of valid requests.
The vulnerability allows attackers to create unreachable peer sessions that exhaust ZeroMQ socket quotas, leading to EngineCore crashes and service disruptions.
The flaw allows attackers to trigger an assertion failure in vLLM's NIXL connector by submitting multi-prompt completion requests, leading to service disruption.
The flaw allows attackers to cause a denial of service by sending requests with incomplete metadata entries, leading to engine termination and failure of routed requests.
DesktopSMS 1.11.0 allows local attackers to perform unauthorized SMS operations by interacting with the local service, potentially leading to the transmission and retrieval of SMS content and the persistence of attacker-controlled identities.