WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product studio✕
Overview 919 matches · 63 in Waratek scope · 28 protected · 26 exploited · 11 CISA KEV · 84 public PoC · 32 EPSS ≥ 0.5
919matches 63in Waratek scope6.9% 28protected3.0% 26exploited2.8% 11CISA KEV1.2% 84public PoC9.1% 32EPSS ≥ 0.53.5%
Protected by Waratek 28 3.0% Rule in development 0 0.0% Mitigation candidate 2 0.2% No exploit published 33 3.6% Outside Waratek scope 11 1.2% Not applicable 845 91.9% Withdrawn CVE 0 0.0%
Critical 76 8.3% High 585 63.7% Medium 243 26.4% Low 15 1.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 28 3.0% partly blocked 0 0.0% not blocked 891 97.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 26 2.8% Working exploit published 60 6.5% Proof of concept only 54 5.9% Forecast only 5 0.5% No public exploit 774 84.2%
split by peak 132 / year
Not applicable: 845Outside Waratek scope: 11No exploit published: 33Mitigation candidate: 2Protected by Waratek: 28 Low: 15Medium: 243High: 585Critical: 76 not blocked: 891blocked by ARMR today: 28 No public exploit: 774Forecast only: 5Proof of concept only: 54Working exploit published: 60Exploited: 26
20004 Not applicable4 High2 Medium2 not blocked4 Working exploit published3 No public exploit1 20011 Not applicable1 High1 not blocked1 No public exploit1 20022 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20030 20043 Outside Waratek scope1 Not applicable2 High3 not blocked3 Working exploit published2 No public exploit1 20057 Not applicable7 High4 Medium3 not blocked7 Exploited1 No public exploit6 20069 Not applicable9 High5 Medium3 Low1 not blocked9 Exploited1 Working exploit published4 No public exploit4 200716 Not applicable16 High8 Medium8 not blocked16 Exploited1 Working exploit published8 No public exploit7 200817 Not applicable17 High14 Medium3 not blocked17 Exploited1 Working exploit published7 No public exploit9 200921 Not applicable21 High17 Medium4 not blocked21 Exploited3 Working exploit published8 No public exploit10 20106 Not applicable6 High3 Medium2 Low1 not blocked6 Working exploit published1 No public exploit5 201120 Not applicable20 High13 Medium7 not blocked20 Working exploit published3 No public exploit17 20129 Not applicable9 High3 Medium6 not blocked9 Working exploit published1 No public exploit8 201320 Not applicable20 High7 Medium11 Low2 not blocked20 Working exploit published2 No public exploit18 201415 Not applicable15 Critical3 High4 Medium8 not blocked15 Exploited3 Working exploit published1 No public exploit11 20158 No exploit published2 Not applicable6 High3 Medium4 Low1 not blocked8 No public exploit8 20167 Protected by Waratek1 Not applicable6 Critical2 High4 Medium1 blocked by ARMR today1 not blocked6 No public exploit7 201718 Protected by Waratek1 Outside Waratek scope1 Not applicable16 Critical6 High5 Medium7 blocked by ARMR today1 not blocked17 Working exploit published1 No public exploit17 201839 Protected by Waratek2 No exploit published1 Outside Waratek scope2 Not applicable34 Critical6 High22 Medium11 blocked by ARMR today2 not blocked37 Exploited3 Working exploit published4 No public exploit32 201946 Protected by Waratek6 Outside Waratek scope1 Not applicable39 Critical5 High24 Medium17 blocked by ARMR today6 not blocked40 Exploited2 Working exploit published4 Proof of concept only1 Forecast only1 No public exploit38 202089 Protected by Waratek5 No exploit published7 Outside Waratek scope3 Not applicable74 Critical4 High63 Medium20 Low2 blocked by ARMR today5 not blocked84 Exploited1 Working exploit published1 No public exploit87 2021102 Protected by Waratek7 No exploit published11 Outside Waratek scope1 Not applicable83 Critical6 High73 Medium20 Low3 blocked by ARMR today7 not blocked95 Exploited6 Working exploit published1 Proof of concept only1 Forecast only3 No public exploit91 202276 Protected by Waratek4 Mitigation candidate1 No exploit published8 Outside Waratek scope1 Not applicable62 Critical6 High53 Medium16 Low1 blocked by ARMR today4 not blocked72 Exploited1 Working exploit published2 Proof of concept only4 No public exploit69 2023113 Protected by Waratek1 Mitigation candidate1 No exploit published2 Not applicable109 Critical14 High74 Medium24 Low1 blocked by ARMR today1 not blocked112 Exploited2 Working exploit published2 Proof of concept only12 Forecast only1 No public exploit96 202487 No exploit published1 Not applicable86 Critical7 High60 Medium19 Low1 not blocked87 Working exploit published1 Proof of concept only8 No public exploit78 202552 Protected by Waratek1 No exploit published1 Not applicable50 Critical7 High34 Medium11 blocked by ARMR today1 not blocked51 Working exploit published3 Proof of concept only6 No public exploit43 2026132 Outside Waratek scope1 Not applicable131 Critical10 High86 Medium34 Low2 not blocked132 Exploited1 Proof of concept only22 No public exploit109
200220052008201120142017202020232026
919 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 10 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-5708 High 2026-04-06 Not applicable No public exploit Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
CVE-2026-5707 High 2026-04-06 Not applicable No public exploit Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host via a crafted session name. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
CVE-2024-14032 High 2026-04-06 Not applicable No public exploit Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.
CVE-2019-25655 Medium 2026-03-30 Not applicable Proof of concept only Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the server connection dialog. Attackers can trigger the crash by entering a malformed server name or address containing repeated characters through the Tools menu Connect to New Server interface.
CVE-2018-25227 Medium 2026-03-30 Not applicable Proof of concept only Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Host field. Attackers can trigger the crash by pasting a 256-byte buffer of repeated characters into the Host parameter during server connection attempts.
CVE-2019-25625 Medium 2026-03-23 Not applicable Proof of concept only Blob Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key entry mechanism. Attackers can create a text file with a large buffer of repeated characters and trigger the application to read it, causing the application to crash or become unresponsive.
CVE-2019-25624 Medium 2026-03-23 Not applicable Proof of concept only Liquid Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters during application runtime, causing the application to become unresponsive or terminate abnormally.
CVE-2019-25623 Medium 2026-03-23 Not applicable Proof of concept only Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can create a text file with arbitrary character sequences and trigger the application to process the input, causing the application to become unresponsive or terminate abnormally.
CVE-2019-25622 Medium 2026-03-23 Not applicable No public exploit Paint Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key entry mechanism. Attackers can create a text file with a large buffer of characters and trigger the application to read it, causing the application to crash and become unavailable.
CVE-2019-25621 Medium 2026-03-23 Not applicable Proof of concept only Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters, causing the application to become unresponsive or terminate abnormally.
CVE-2019-25620 Medium 2026-03-23 Not applicable Proof of concept only Tree Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters during application runtime, causing the application to become unresponsive or terminate abnormally.
CVE-2019-25567 Medium 2026-03-21 Not applicable Proof of concept only Valentina Studio 9.0.5 Linux contains a buffer overflow vulnerability in the Host field of the connection dialog that allows local attackers to crash the application by supplying an oversized input string. Attackers can trigger the vulnerability by pasting a crafted buffer exceeding 264 bytes into the Host field during server connection attempts, causing a denial of service.
CVE-2019-25558 Medium 2026-03-21 Not applicable No public exploit Selfie Studio 2.17 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by supplying an excessively long buffer. Attackers can paste a large string of characters into the New Width or New Height field to trigger a buffer overflow that crashes the application.
CVE-2019-25557 Medium 2026-03-21 Not applicable Proof of concept only TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability that allows local attackers to crash the application by importing a malformed .srp script file. Attackers can create a .srp file containing an excessively large buffer and import it through the Script Player interface to trigger an application crash.
CVE-2019-25556 Medium 2026-03-21 Not applicable Proof of concept only TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by supplying an excessively long buffer. Attackers can paste a malicious string into the New Width or New Height field to trigger a buffer overflow that causes the application to crash.
CVE-2019-25555 Medium 2026-03-21 Not applicable Proof of concept only TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Script Recorder component that allows local attackers to crash the application by supplying an excessively large buffer. Attackers can paste a malicious string containing 500,000 characters into the Description field of the Script Recorder dialog to trigger an application crash.
CVE-2026-32638 Low 2026-03-18 Not applicable Proof of concept only StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request `rank=owner` and receive owner account records, including IDs, usernames, display names, and email addresses, even though the adjacent `getUser` endpoint correctly blocks admins from viewing owner users. This is an authorization inconsistency inside the same user-management surface. Version 0.4.4 fixes the issue.
CVE-2026-32106 High 2026-03-11 Not applicable Proof of concept only StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3.
CVE-2026-32104 Medium 2026-03-11 Not applicable Proof of concept only StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.
CVE-2026-32103 High 2026-03-11 Not applicable Proof of concept only StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller's identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system. This vulnerability is fixed in 0.4.3.
CVE-2026-32101 High 2026-03-11 Not applicable Proof of concept only StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1.
CVE-2026-30945 High 2026-03-10 Not applicable No public exploit StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0.
CVE-2026-30944 High 2026-03-10 Not applicable Proof of concept only StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0.
CVE-2026-21523 High 2026-02-10 Not applicable No public exploit Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
CVE-2026-21518 High 2026-02-10 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21257 High 2026-02-10 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.
CVE-2026-21256 High 2026-02-10 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2020-37162 High 2026-02-07 Not applicable Proof of concept only Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload of 1608 bytes to trigger a stack-based buffer overflow and execute commands through the registration key field.
CVE-2020-37161 High 2026-02-07 Not applicable Proof of concept only Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name field with malicious payload. Attackers can craft a specially designed payload to trigger remote code execution, demonstrating the ability to run system commands like launching the calculator.
CVE-2026-24134 Medium 2026-01-28 Not applicable Proof of concept only StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue.
CVE-2026-21520 High 2026-01-22 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
CVE-2026-22033 High 2026-01-12 Not applicable Proof of concept only Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their custom_hotkeys) can inject JavaScript code that executes in other users’ browsers when those users load any page using the templates/base.html template. Because the application exposes an API token endpoint (/api/current-user/token) to the browser and lacks robust CSRF protection on some API endpoints, the injected script may fetch the victim’s API token or call token reset endpoints — enabling full account takeover and unauthorized API access.
CVE-2025-51962 Medium 2025-12-15 Not applicable No public exploit A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function.
CVE-2025-64660 High 2025-11-20 Not applicable No public exploit Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
CVE-2025-62453 Medium 2025-11-11 Not applicable No public exploit Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
CVE-2025-62214 Medium 2025-11-11 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.
CVE-2025-55315 Critical 2025-10-14 Not applicable Working exploit published Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVE-2025-55248 Medium 2025-10-14 Not applicable No public exploit Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVE-2025-55240 High 2025-10-14 Not applicable No public exploit Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-61929 Critical 2025-10-10 Not applicable Proof of concept only Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called `cherrystudio://`. When handling the MCP installation URL, it parses the base64-encoded configuration data and directly executes the command within it. In the files `src/main/services/ProtocolClient.ts` and `src/main/services/urlschema/mcp-install.ts`, when receiving a URL of the `cherrystudio://mcp` type, the `handleMcpProtocolUrl` function is called for processing. If an attacker crafts malicious content and posts it on a website or elsewhere (there are many exploitation methods, such as creating a malicious website with a button containing this malicious content), when the user clicks it, since the pop-up window contains normal content, the direct click is considered a scene action, and the malicious command is directly triggered, leading to the user being compromised. As of time of publication, no known patched versions exist.
CVE-2025-61692 High 2025-10-02 Not applicable No public exploit VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
CVE-2025-61691 High 2025-10-02 Not applicable No public exploit VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
CVE-2025-58777 High 2025-10-02 Not applicable No public exploit VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
CVE-2025-33116 Medium 2025-09-25 Not applicable No public exploit IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-10492 High 2025-09-16 Protected by Waratek No public exploit A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
CVE-2025-55319 Critical 2025-09-12 Not applicable No public exploit Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2025-35452 Critical 2025-09-05 Not applicable No public exploit PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
CVE-2025-54382 Critical 2025-08-13 Not applicable Proof of concept only Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirection endpoints and failure to properly sanitize the URL. This issue has been patched in version 1.5.2.
CVE-2025-54074 High 2025-08-13 Not applicable Proof of concept only Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth authorization server endpoints and trick victims into connecting it, leading to OS command injection in vulnerable clients. This issue has been patched in version 1.5.2.
CVE-2025-53773 High 2025-08-12 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2025-54063 Critical 2025-08-11 Not applicable Proof of concept only Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution on the victim’s machine. This issue has been patched in version 1.5.1.
CVE-2025-7427 Medium 2025-07-22 Not applicable No public exploit Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio.
CVE-2025-49739 High 2025-07-08 Not applicable No public exploit Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-6384 High 2025-06-19 No exploit published No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
CVE-2025-47959 High 2025-06-13 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.
CVE-2025-30399 High 2025-06-13 Not applicable No public exploit Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2025-5173 Medium 2025-05-26 Not applicable No public exploit A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVE-2024-6712 Medium 2025-05-15 Not applicable Proof of concept only The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2025-47783 High 2025-05-14 Not applicable Working exploit published Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. Version 1.18.0 contains a patch for the issue.
CVE-2025-32703 Medium 2025-05-13 Not applicable No public exploit Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
CVE-2025-32702 High 2025-05-13 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2025-30387 Critical 2025-05-13 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-26646 High 2025-05-13 Not applicable No public exploit External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.
CVE-2025-21264 High 2025-05-13 Not applicable No public exploit Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2025-32726 Medium 2025-04-12 Not applicable No public exploit Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
CVE-2025-29803 High 2025-04-12 Not applicable No public exploit Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-29804 High 2025-04-08 Not applicable No public exploit Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-29802 High 2025-04-08 Not applicable No public exploit Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-26682 High 2025-04-08 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2025-26631 High 2025-03-11 Not applicable No public exploit Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
CVE-2025-25003 High 2025-03-11 Not applicable No public exploit Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-24998 High 2025-03-11 Not applicable No public exploit Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-24070 High 2025-03-11 Not applicable No public exploit Weak authentication in ASP.NET Core &amp; Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-25297 High 2025-02-14 Not applicable Proof of concept only Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3_endpoint parameter. This endpoint URL is passed directly to the boto3 AWS SDK without proper validation or restrictions on the protocol or destination. The vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal services by specifying them as the S3 endpoint. When the storage sync operation is triggered, the application attempts to make S3 API calls to the specified endpoint, effectively making HTTP requests to the target service and returning the response in error messages. This SSRF vulnerability enables attackers to bypass network segmentation and access internal services that should not be accessible from the external network. The vulnerability is particularly severe because error messages from failed requests contain the full response body, allowing data exfiltration from internal services. Version 1.16.0 contains a patch for the issue.
CVE-2025-25296 Medium 2025-02-14 Not applicable Working exploit published Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue.
CVE-2025-24042 High 2025-02-11 Not applicable No public exploit Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
CVE-2025-24039 High 2025-02-11 Not applicable No public exploit Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-21206 High 2025-02-11 Not applicable No public exploit Visual Studio Installer Elevation of Privilege Vulnerability
CVE-2025-21405 High 2025-01-14 Not applicable No public exploit Visual Studio Elevation of Privilege Vulnerability
CVE-2025-21178 High 2025-01-14 Not applicable No public exploit Visual Studio Remote Code Execution Vulnerability
CVE-2025-21176 High 2025-01-14 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21173 High 2025-01-14 Not applicable No public exploit .NET Elevation of Privilege Vulnerability
CVE-2025-21172 High 2025-01-14 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21171 High 2025-01-14 Not applicable No public exploit .NET Remote Code Execution Vulnerability
CVE-2024-10787 Medium 2024-12-04 Not applicable No public exploit The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.
CVE-2024-49038 Critical 2024-11-26 Not applicable No public exploit Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
CVE-2024-49044 Medium 2024-11-12 Not applicable No public exploit Visual Studio Elevation of Privilege Vulnerability
CVE-2024-43499 High 2024-11-12 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-43498 Critical 2024-11-12 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2023-1932 Medium 2024-11-07 No exploit published No public exploit A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
CVE-2024-9579 High 2024-11-05 Not applicable No public exploit A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
CVE-2024-48870 Medium 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.
CVE-2024-47801 High 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
CVE-2024-47549 High 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
CVE-2024-47406 Critical 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.
CVE-2024-47005 High 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.
CVE-2024-45842 Medium 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retrieved when processing crafted HTTP requests.
CVE-2024-45829 High 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
CVE-2024-43424 High 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
CVE-2024-42420 High 2024-10-25 Not applicable No public exploit Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOAP messages. Crafted HTTP requests may cause affected products crashed.
‹ prev page 2 of 10 next ›