Checkmarx

Latest CVEs · RSS

• CVE-2026-109449 2026-10-15 · CVSS 8.7
  In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no b
• CVE-2026-109413 2026-10-15 · CVSS 8.7
  In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence
• CVE-2026-108082 2026-10-15 · CVSS 8.7
  Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUti
• CVE-2026-9591 2026-06-17 · CVSS 6.9
  Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modi
• CVE-2026-11975 2026-06-17 · CVSS 6.2
  Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary
• CVE-2014-125128 2025-09-08 · CVSS 6.1
  'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`hr
• CVE-2019-25225 2025-09-08 · CVSS 6.1
  `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content w
• CVE-2014-125127 2025-09-03 · CVSS 7.5
  The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Reques
• CVE-2025-6050 2025-06-17 · CVSS 4.8
  Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "d
• CVE-2018-25110 2025-05-23 · CVSS 6.9
  Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expres
• CVE-2025-0825 2025-02-04 · CVSS 6.9
  cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit
• CVE-2024-8374 2024-09-03 · CVSS 7.8
  UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerabil
• CVE-2024-5685 2024-06-14 · CVSS 7.6
  Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.
• CVE-2024-4068 2024-05-13 · CVSS 7.5
  The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.j
• CVE-2024-4067 2024-05-13 · CVSS 5.3
  The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in