High
CVE-2022-24294
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,856
Reset filters
Critical
CVE-2022-34983
The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.
Unrated
CVE-2022-34982
The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.
Unrated
CVE-2022-34981
The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.
High
Exploited in attacks
CVE-2022-33891
Apache Spark UI can allow impersonation if ACLs enabled
Critical
CVE-2021-36711
Octobot mishandles Tentacles upload
High
CVE-2019-10800
Codecov does not sanitize gcov arguments
Medium
CVE-2022-30187
Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library
Medium
CVE-2022-25303
Whoogle Search Cross-site Scripting via string parameter
Critical
CVE-2022-31573
ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function
Critical
CVE-2022-31558
Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely
Critical
CVE-2022-31506
SatyaLab opendiamond 10.1.1 vulnerable to path traversal because Flask send_file function used unsafely
Critical
CVE-2022-31507
Ganga allows absolute path traversal
Critical
CVE-2022-35411
rpc.py vulnerable to Deserialization of Untrusted Data
High
CVE-2022-35410
mat2 before 0.13.0 allows directory traversal during the ZIP archive cleaning process.
Medium
CVE-2021-37839
Apache Superset allows authenticated users to access metadata they have no permission to
Medium
CVE-2022-31124
Possible leak of key's raw field if declared length is incorrect
Medium
ghsa-c58j-88f5-h53f
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pycares
High
CVE-2022-30290
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their reg
Medium
CVE-2022-30289
A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerability to upload a malicious file that will
Medium
CVE-2022-2309
lxml NULL Pointer Dereference allows attackers to cause a denial of service
Critical
CVE-2022-34265
Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
Critical
CVE-2022-31605
Unsafe yaml deserialization in NVFlare
Critical
CVE-2022-31604
Unsafe deserialisation in the PKI implementation scheme of NVFlare
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.