U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
Icon for New NVD Communications and Status Updates Page
New Communications Page
The NVD now supports CVSS version 4.0!
CVSS v4.0 Support
The letters N V D typed out in binary
2.0 APIs

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics.

For information on how to cite the NVD, including the database's Digital Object Identifier (DOI), please consult NIST's Public Data Repository.

Last 20 Scored Vulnerability IDs & Summaries CVSS Severity

  • CVE-2024-51517 - Vulnerability of improper memory access in the phone service module Impact: Successful exploitation of this vulnerability may affect availability.
    Published: November 05, 2024; 5:21:10 AM -0500

    V3.1: 5.5 MEDIUM

  • CVE-2024-51518 - Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may affect availability.
    Published: November 05, 2024; 5:21:10 AM -0500

    V3.1: 7.5 HIGH

  • CVE-2024-51519 - Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability.
    Published: November 05, 2024; 5:21:11 AM -0500

    V3.1: 5.5 MEDIUM

  • CVE-2024-50466 - Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite – Advanced Dark Mode Plugin for WordPress: from n/a throu... read CVE-2024-50466
    Published: October 29, 2024; 1:15:04 PM -0400

    V3.1: 8.8 HIGH

  • CVE-2024-9990 - The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in the 'crypto_connect_ajax_process::check' function. This makes it possible for unauthenti... read CVE-2024-9990
    Published: October 29, 2024; 1:15:05 PM -0400

    V3.1: 8.8 HIGH

  • CVE-2024-50459 - Missing Authorization vulnerability in HM Plugin WordPress Stripe Donation and Payment Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Stripe Donation and Payment Plugin: from n/a through... read CVE-2024-50459
    Published: October 29, 2024; 1:15:04 PM -0400

    V3.1: 9.8 CRITICAL

  • CVE-2024-10491 - A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can... read CVE-2024-10491
    Published: October 29, 2024; 1:15:03 PM -0400

    V3.1: 5.3 MEDIUM

  • CVE-2023-5816 - The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instan... read CVE-2023-5816
    Published: October 29, 2024; 11:15:03 PM -0400

    V3.1: 4.9 MEDIUM

  • CVE-2024-8627 - The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authe... read CVE-2024-8627
    Published: October 29, 2024; 11:15:04 PM -0400

    V3.1: 5.4 MEDIUM

  • CVE-2024-45086 - IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
    Published: November 04, 2024; 3:15:05 PM -0500

    V3.1: 5.5 MEDIUM

  • CVE-2024-21264 - Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Activity Guide Composer). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged att... read CVE-2024-21264
    Published: October 15, 2024; 4:15:17 PM -0400

    V3.1: 5.4 MEDIUM

  • CVE-2024-21258 - Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network acce... read CVE-2024-21258
    Published: October 15, 2024; 4:15:16 PM -0400

    V3.1: 5.3 MEDIUM

  • CVE-2024-21257 - Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization). The supported version that is affected is 11.2.18.0.000. Easily exploitable vulnerability allows low privileged attacker with access to the ph... read CVE-2024-21257
    Published: October 15, 2024; 4:15:16 PM -0400

    V3.1: 3.0 LOW

  • CVE-2024-21250 - Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager Specification). Supported versions that are affected are 12.2.13-12.2.14. Easily exploitable vulnerability allows... read CVE-2024-21250
    Published: October 15, 2024; 4:15:15 PM -0400

    V3.1: 8.1 HIGH

  • CVE-2024-21249 - Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HT... read CVE-2024-21249
    Published: October 15, 2024; 4:15:14 PM -0400

    V3.1: 4.3 MEDIUM

  • CVE-2024-10841 - A vulnerability classified as critical was found in romadebrian WEB-Sekolah 1.0. Affected by this vulnerability is an unknown functionality of the file /Proses_Kirim.php of the component Mail Handler. The manipulation of the argument Name leads to... read CVE-2024-10841
    Published: November 05, 2024; 9:15:14 AM -0500

    V3.1: 8.0 HIGH

  • CVE-2024-10840 - A vulnerability classified as problematic has been found in romadebrian WEB-Sekolah 1.0. Affected is an unknown function of the file /Admin/akun_edit.php of the component Backend. The manipulation of the argument kode leads to cross site scripting... read CVE-2024-10840
    Published: November 05, 2024; 8:15:03 AM -0500

    V3.1: 4.8 MEDIUM

  • CVE-2024-10842 - A vulnerability, which was classified as problematic, has been found in romadebrian WEB-Sekolah 1.0. Affected by this issue is some unknown functionality of the file /Admin/Proses_Edit_Akun.php of the component Backend. The manipulation of the arg... read CVE-2024-10842
    Published: November 05, 2024; 9:15:14 AM -0500

    V3.1: 4.8 MEDIUM

  • CVE-2024-10844 - A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file search.php. The manipulation of the argument s leads to sql injection. It is possible to initia... read CVE-2024-10844
    Published: November 05, 2024; 10:15:22 AM -0500

    V3.1: 9.8 CRITICAL

  • CVE-2024-10845 - A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file book_detail.php. The manipulation of the argument id leads to sql injection. The attack... read CVE-2024-10845
    Published: November 05, 2024; 10:15:22 AM -0500

    V3.1: 9.8 CRITICAL

Created September 20, 2022 , Updated August 27, 2024