NVD Vulnerability Information Top

Show Search Menu

Vendor Name
プロダクト・サービス名
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
In descending order of publication date
In descending order of update date
Number of items displayed

NVD Vulnerability Information Top

You can search the list of vulnerabilities managed by the NVD (National Vulnerability Database).
Since vulnerability information is often updated before JVN (Japan Vulnerability Note), vulnerabilities that are not listed in JVN may be updated.

If there is a vulnerability related to JVN (Japan Vulnerability Note), the information will be displayed on the detail page.

To search by CWE, please refer to the CWE Overview and check the CWE number.

CRITICAL
HIGH
MEDIUM
LOW

Update Date:May 13, 2026, 5:05 a.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Show Affected	Exploit PoC Search
312401	6.1	MEDIUM Network	wpengine	advanced_custom_fields	Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting …	CWE-79 Cross-site Scripting	CVE-2024-45429	2024-09-14 05:48	2024-09-5	Show	GitHub Exploit DB Packet Storm

312402	8.8	HIGH Network	dell	smartfabric_os10	Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A…	CWE-77 Command Injection	CVE-2024-38486	2024-09-14 05:36	2024-09-6	Show	GitHub Exploit DB Packet Storm

312403	7.2	HIGH Network	wedevs	wp_user_frontend	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a throug…	CWE-89 SQL Injection	CVE-2024-38693	2024-09-14 05:35	2024-08-29	Show	GitHub Exploit DB Packet Storm

312404	5.4	MEDIUM Network	qnap	notes_station_3	A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We hav…	CWE-79 Cross-site Scripting	CVE-2024-27126	2024-09-14 05:31	2024-09-7	Show	GitHub Exploit DB Packet Storm

312405	7.5	HIGH Network	accordors	accord_ors	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data.This issue affects Accord ORS: before 7.3.2.1.	NVD-CWE-noinfo	CVE-2024-1744	2024-09-14 05:30	2024-09-6	Show	GitHub Exploit DB Packet Storm

312406	6.1	MEDIUM Network	br-automation	industrial_automation_aprol	Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript code in the context of the user's brows…	CWE-79 Cross-site Scripting	CVE-2024-5624	2024-09-14 05:23	2024-08-29	Show	GitHub Exploit DB Packet Storm

312407	7.8	HIGH Local	br-automation	industrial_automation_aprol	An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated …	CWE-426 Untrusted Search Path	CVE-2024-5622	2024-09-14 05:21	2024-08-29	Show	GitHub Exploit DB Packet Storm

312408	7.8	HIGH Local	br-automation	industrial_automation_aprol	An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.	CWE-426 Untrusted Search Path	CVE-2024-5623	2024-09-14 05:19	2024-08-29	Show	GitHub Exploit DB Packet Storm

312409	8.8	HIGH Network	portabilis	i-educar	i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 b…	CWE-89 SQL Injection	CVE-2024-45059	2024-09-14 05:09	2024-08-29	Show	GitHub Exploit DB Packet Storm

312410	8.1	HIGH Network	portabilis	i-educar	i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal vie…	CWE-862 Missing Authorization	CVE-2024-45058	2024-09-14 05:06	2024-08-29	Show	GitHub Exploit DB Packet Storm

312411	6.1	MEDIUM Network	portabilis	i-educar	i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was i…	CWE-79 Cross-site Scripting	CVE-2024-45057	2024-09-14 05:03	2024-08-29	Show	GitHub Exploit DB Packet Storm

312412	7.5	HIGH Network	huawei	harmonyos emui	Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability.	NVD-CWE-noinfo	CVE-2024-45442	2024-09-14 05:00	2024-09-4	Show	GitHub Exploit DB Packet Storm

312413	5.4	MEDIUM Network	squaredup	squaredup_ds_for_scom	SquaredUp DS for SCOM 6.2.1.11104 allows XSS.	CWE-79 Cross-site Scripting	CVE-2024-45180	2024-09-14 04:55	2024-09-4	Show	GitHub Exploit DB Packet Storm

312414	8.1	HIGH Network	idec	windo\/i-nv4 windldr	Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user cre…	CWE-312 Cleartext Storage of Sensitive Information	CVE-2024-41716	2024-09-14 04:53	2024-09-4	Show	GitHub Exploit DB Packet Storm

312415	4.3	MEDIUM Network	audiobookshelf	audiobookshelf	audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones they have permission to). However, the `LibraryController` i…	CWE-22 Path Traversal	CVE-2024-43797	2024-09-14 04:49	2024-09-3	Show	GitHub Exploit DB Packet Storm

312416	9.8	CRITICAL Network	zyxel	nwa110ax_firmware nwa1123-ac_pro_firmware nwa1123acv3_firmware nwa130be_firmware nwa210ax_firmware nwa220ax-6e_firmware nwa50ax_firmware nwa50ax_pro_firmware nwa55axe_firmware…	The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and e…	CWE-78 OS Command	CVE-2024-7261	2024-09-14 04:39	2024-09-3	Show	GitHub Exploit DB Packet Storm

312417	9.8	CRITICAL Network	cisco	smart_license_utility	A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential. This vulnerability is …	CWE-798 Use of Hard-coded Credentials	CVE-2024-20439	2024-09-14 04:35	2024-09-5	Show	GitHub Exploit DB Packet Storm

312418	5.3	MEDIUM Network	funnelforms	funnelforms_free	The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…	CWE-862 Missing Authorization	CVE-2024-7447	2024-09-14 04:33	2024-08-28	Show	GitHub Exploit DB Packet Storm

312419	5.3	MEDIUM Network	permalink_manager_lite_project	permalink_manager_lite	The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in al…	CWE-862 Missing Authorization	CVE-2024-8195	2024-09-14 04:28	2024-08-28	Show	GitHub Exploit DB Packet Storm

312420	5.5	MEDIUM Local	cisco	duo_authentication_for_epic	A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system. This vulnerability is due to imprope…	CWE-311 Missing Encryption of Sensitive Data	CVE-2024-20503	2024-09-14 04:24	2024-09-5	Show	GitHub Exploit DB Packet Storm

312421	9.8	CRITICAL Network	fabianros	hospital_management_system	A vulnerability was found in code-projects Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component L…	CWE-89 SQL Injection	CVE-2024-8368	2024-09-14 04:23	2024-09-1	Show	GitHub Exploit DB Packet Storm

312422	3.9	LOW Physics	redhat opensc_project	enterprise_linux opensc	A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially craft…	CWE-908 Use of Uninitialized Resource	CVE-2024-45617	2024-09-14 04:21	2024-09-4	Show	GitHub Exploit DB Packet Storm

312423	3.9	LOW Physics	redhat opensc_project	enterprise_linux opensc	A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially craft…	CWE-908 Use of Uninitialized Resource	CVE-2024-45616	2024-09-14 04:21	2024-09-4	Show	GitHub Exploit DB Packet Storm

312424	3.9	LOW Physics	redhat opensc_project	enterprise_linux opensc	A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be initialized (as arguments to other function…	CWE-908 Use of Uninitialized Resource	CVE-2024-45615	2024-09-14 04:21	2024-09-4	Show	GitHub Exploit DB Packet Storm

312425	5.4	MEDIUM Network	wpzoom	wpzoom_portfolio	The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in al…	CWE-79 Cross-site Scripting	CVE-2024-8276	2024-09-14 04:19	2024-08-31	Show	GitHub Exploit DB Packet Storm

312426	6.5	MEDIUM Network	microfocus	netiq_advanced_authentication	A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authent…	CWE-312 Cleartext Storage of Sensitive Information	CVE-2021-22509	2024-09-14 03:05	2024-08-28	Show	GitHub Exploit DB Packet Storm

312427	8.8	HIGH Adjacent	microfocus	netiq_advanced_authentication	Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. This issue affects NetIQ Advance Authent…	CWE-326 Inadequate Encryption Strength	CVE-2021-38121	2024-09-14 03:04	2024-08-28	Show	GitHub Exploit DB Packet Storm

312428	7.2	HIGH Network	microfocus	netiq_advanced_authentication	A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. T…	CWE-77 Command Injection	CVE-2021-38120	2024-09-14 03:04	2024-08-28	Show	GitHub Exploit DB Packet Storm

312429	8.2	HIGH Network	microfocus	netiq_advanced_authentication	A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information. This issue affects NetIQ Advance Authentication …	CWE-79 Cross-site Scripting	CVE-2021-38122	2024-09-14 03:03	2024-08-28	Show	GitHub Exploit DB Packet Storm

312430	5.5	MEDIUM Local	microfocus	netiq_advanced_authentication	A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version before 6.3.5.1	NVD-CWE-noinfo	CVE-2021-22529	2024-09-14 03:03	2024-08-28	Show	GitHub Exploit DB Packet Storm

312431	9.9	CRITICAL Network	microfocus	netiq_advanced_authentication	A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise…	CWE-307 mproper Restriction of Excessive Authentication Attempts	CVE-2021-22530	2024-09-14 02:15	2024-08-28	Show	GitHub Exploit DB Packet Storm

312432	7.8	HIGH Local	adobe	photoshop	Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio…	CWE-787 Out-of-bounds Write	CVE-2024-45108	2024-09-14 02:00	2024-09-13	Show	GitHub Exploit DB Packet Storm

312433	7.8	HIGH Local	adobe	photoshop	Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio…	CWE-787 Out-of-bounds Write	CVE-2024-43760	2024-09-14 02:00	2024-09-13	Show	GitHub Exploit DB Packet Storm

312434	7.8	HIGH Local	adobe	photoshop	Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Explo…	CWE-119 Incorrect Access of Indexable Resource ('Range Error')	CVE-2024-43756	2024-09-14 02:00	2024-09-13	Show	GitHub Exploit DB Packet Storm

312435	7.8	HIGH Local	adobe	photoshop	Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio…	CWE-787 Out-of-bounds Write	CVE-2024-45109	2024-09-14 01:59	2024-09-13	Show	GitHub Exploit DB Packet Storm

312436	9.8	CRITICAL Network	adobe	coldfusion	ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An …	CWE-502 Deserialization of Untrusted Data	CVE-2024-41874	2024-09-14 01:57	2024-09-13	Show	GitHub Exploit DB Packet Storm

312437	7.5	HIGH Network	adobe	coldfusion	ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gai…	CWE-287 Improper Authentication	CVE-2024-45113	2024-09-14 01:56	2024-09-13	Show	GitHub Exploit DB Packet Storm

312438	-	-	-	-	Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in clear text within the JSON response when c…	-	CVE-2024-44685	2024-09-14 01:37	2024-09-14	Show	GitHub Exploit DB Packet Storm

312439	-	-	-	-	In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly insufficient to serialize the AUX buffer, …	-	CVE-2024-46713	2024-09-14 01:37	2024-09-14	Show	GitHub Exploit DB Packet Storm

312440	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are not guaranteed that anything past the terminating NUL is mapped…	CWE-476 NULL Pointer Dereference	CVE-2024-45021	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312441	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Take state lock during tx timeout reporter mlx5e_safe_reopen_channels() requires the state lock taken. The referenced …	CWE-667 Improper Locking	CVE-2024-45019	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312442	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.	CWE-665 Improper Initialization	CVE-2024-45018	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312443	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 The __vmap_pages_range_noflush() assume…	CWE-787 Out-of-bounds Write	CVE-2024-45022	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312444	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Furth…	CWE-787 Out-of-bounds Write	CVE-2024-45020	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312445	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: netem: fix return value if duplicate enqueue fails There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: net…	CWE-416 Use After Free	CVE-2024-45016	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312446	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec RoCE MPV trace call Prevent the call trace below from happening, by not allowing IPsec creation over a slave,…	NVD-CWE-noinfo	CVE-2024-45017	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312447	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Check USB endpoints when probing device Ensure, as the driver probes the device, that all endpoints that the driv…	NVD-CWE-noinfo	CVE-2024-45011	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312448	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepte…	NVD-CWE-noinfo	CVE-2024-45009	2024-09-14 01:36	2024-09-12	Show	GitHub Exploit DB Packet Storm

312449	-	-	-	-	An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.	-	CVE-2024-37397	2024-09-14 01:35	2024-09-12	Show	GitHub Exploit DB Packet Storm

312450	5.5	MEDIUM Local	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid possible physmem_info segment corruption When physical memory for the kernel image is allocated it does not cons…	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2024-45014	2024-09-14 01:35	2024-09-12	Show	GitHub Exploit DB Packet Storm