Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2025-8695

Reflected XSS in Netcad Software's NetGIS Server

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This issue affects NetGIS Server: from 5.2.4 through 22.08.2025.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-8855

2FA Expiry Bypass in Optimus Software's Brokerage Automation

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Optimus Software
Products
Brokerage Automation
CVE-2025-8884

IDOR in VHS Electronic Software's ACE Center

Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers. This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vhs Electronic Software
Products
Ace Center
CVE-2025-8886

Authorization Bypass in Usta Information Systems' Aybs Interaktif

Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorization vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Privilege Abuse, Authentication Bypass. This issue affects Aybs Interaktif: from 2024 through 28082025.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Usta
Products
Aybs
CVE-2026-48840

Exim Proxy Misconfiguration Causes Uninitialized Memory Disclosure

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Exim
Products
Exim
CVE-2025-8887

IDOR in Usta Information Systems' Aybs Interaktif

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs Interaktif: from 2024 through 28082025.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Usta
Products
Aybs
CVE-2025-9031

Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web

Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netdatasoft
Products
Divvy Drive
CVE-2025-9035

Reflected XSS in Horato Internet Technologies' Virtual Library Platform

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-9062

IDOR in MeCODE Informatics' Envanty

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6.   NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Mecode Informatics And Engineering Services
Products
Envanty
CVE-2025-9342

IDOR in Anadolu Hayat Emeklilik's AHE Mobile

Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobile: from 1.9.7 before 1.9.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-9588

OS Command Injection in Iron Mountain's enVision

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed
Vendors
Ironmountain Linux
Products
Envision Linux Kernel
CVE-2025-9798

Stored XSS in Netcad Software's Netigma

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Netcad
Products
Netigma
CVE-2025-9846

Unrestricted File Upload in TaletSys Inka.Net

Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed
Vendors
Talentsys
Products
Inka Net
CVE-2025-9902

IDOR in Akınsoft QRMenu

Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse. This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-9969

Reflected XSS in Vizly Web Design's Real Estate Packages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS. This issue affects Real Estate Packages: before 5.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-9986

Improper Access Control in Vadi Corporate Information System's DIGIKENT

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. DIGIKENT allows Excavation. This issue affects DIGIKENT: through 13092025.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Vadi Corporate Information Systems
Products
Digikent
CVE-2025-10024

IDOR in EXERT Computer Technologies' Education Management System

Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection. This issue affects Education Management System: through 23.09.2025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Exert
Products
Education Management System
CVE-2025-10161

Authentication Bypass in Turkguven's Perfektive

Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass. This issue affects Perfektive: before Version: 12574 Build: 2701.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Turkguven
Products
Perfektive
CVE-2026-42250

Off-by-One Leading to Out-of-Bounds Write in bzip2

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bzip
Products
Bzip2
CVE-2025-10174

Improper Access Control in Pan Software's PanCafe Pro

Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd. PanCafe Pro allows Flooding. This issue affects PanCafe Pro: from < 3.3.2 through 23092025.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Pan Software & Information Technologies
Products
Pancafe Pro