WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product poi✕
Overview 930 matches · 39 in Waratek scope · 12 protected · 16 exploited · 2 CISA KEV · 59 public PoC · 20 EPSS ≥ 0.5
930matches 39in Waratek scope4.2% 12protected1.3% 16exploited1.7% 2CISA KEV0.2% 59public PoC6.3% 20EPSS ≥ 0.52.2%
Protected by Waratek 12 1.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 27 2.9% Outside Waratek scope 7 0.8% Not applicable 884 95.1% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 930 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 12 1.3% partly blocked 0 0.0% not blocked 918 98.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 16 1.7% Working exploit published 49 5.3% Proof of concept only 82 8.8% Forecast only 11 1.2% No public exploit 772 83.0%
split by peak 118 / year
Not applicable: 884Outside Waratek scope: 7No exploit published: 27Protected by Waratek: 12 Medium: 930 not blocked: 918blocked by ARMR today: 12 No public exploit: 772Forecast only: 11Proof of concept only: 82Working exploit published: 49Exploited: 16
19991 Not applicable1 Medium1 not blocked1 No public exploit1 20001 Not applicable1 Medium1 not blocked1 No public exploit1 20012 Not applicable2 Medium2 not blocked2 No public exploit2 20023 Not applicable3 Medium3 not blocked3 Working exploit published2 No public exploit1 20032 Not applicable2 Medium2 not blocked2 No public exploit2 20045 Not applicable5 Medium5 not blocked5 Working exploit published1 No public exploit4 20053 Outside Waratek scope1 Not applicable2 Medium3 not blocked3 Working exploit published2 No public exploit1 200614 Not applicable14 Medium14 not blocked14 Exploited1 Working exploit published8 No public exploit5 20072 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20087 Not applicable7 Medium7 not blocked7 Working exploit published1 No public exploit6 20093 Not applicable3 Medium3 not blocked3 Working exploit published1 No public exploit2 20109 Not applicable9 Medium9 not blocked9 Exploited1 Working exploit published2 No public exploit6 201110 Not applicable10 Medium10 not blocked10 Working exploit published1 No public exploit9 201231 No exploit published1 Not applicable30 Medium31 not blocked31 Exploited2 Forecast only8 No public exploit21 201315 Not applicable15 Medium15 not blocked15 Exploited1 Working exploit published2 Forecast only2 No public exploit10 201420 Protected by Waratek1 No exploit published1 Not applicable18 Medium20 blocked by ARMR today1 not blocked19 Exploited1 Working exploit published3 No public exploit16 201531 No exploit published1 Not applicable30 Medium31 not blocked31 Working exploit published5 No public exploit26 201622 Protected by Waratek1 No exploit published1 Not applicable20 Medium22 blocked by ARMR today1 not blocked21 Working exploit published3 No public exploit19 201746 Protected by Waratek1 No exploit published3 Not applicable42 Medium46 blocked by ARMR today1 not blocked45 Working exploit published5 No public exploit41 201887 Protected by Waratek2 No exploit published6 Outside Waratek scope1 Not applicable78 Medium87 blocked by ARMR today2 not blocked85 Exploited3 Working exploit published5 No public exploit79 201972 Protected by Waratek2 No exploit published5 Outside Waratek scope4 Not applicable61 Medium72 blocked by ARMR today2 not blocked70 Exploited1 Working exploit published1 No public exploit70 2020118 Protected by Waratek1 No exploit published1 Outside Waratek scope1 Not applicable115 Medium118 blocked by ARMR today1 not blocked117 Working exploit published2 Proof of concept only2 No public exploit114 202167 Protected by Waratek3 No exploit published5 Not applicable59 Medium67 blocked by ARMR today3 not blocked64 Exploited2 Working exploit published2 No public exploit63 202252 Protected by Waratek1 Not applicable51 Medium52 blocked by ARMR today1 not blocked51 Exploited1 Proof of concept only4 No public exploit47 202365 Not applicable65 Medium65 not blocked65 Working exploit published1 Proof of concept only10 Forecast only1 No public exploit53 202453 Not applicable53 Medium53 not blocked53 Proof of concept only13 No public exploit40 202586 No exploit published2 Not applicable84 Medium86 not blocked86 Exploited2 Working exploit published1 Proof of concept only44 No public exploit39 2026103 No exploit published1 Not applicable102 Medium103 not blocked103 Exploited1 Proof of concept only9 No public exploit93
1999200220052008201120142017202020232026
930 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 10 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-97782 Medium 2026-10-13 Not applicable No public exploit Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
CVE-2026-88209 Medium 2026-10-13 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-88208 Medium 2026-10-13 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-85932 Medium 2026-10-13 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-70298 Medium 2026-10-13 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-70259 Medium 2026-10-13 Not applicable No public exploit Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-70217 Medium 2026-10-13 Not applicable No public exploit Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-105720 Medium 2026-10-13 Not applicable No public exploit Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-105719 Medium 2026-10-13 Not applicable No public exploit Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-105713 Medium 2026-10-13 Not applicable No public exploit Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
CVE-2026-102865 Medium 2026-10-13 Not applicable No public exploit Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-102864 Medium 2026-10-13 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-102859 Medium 2026-10-13 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-25274 Medium 2026-10-06 Not applicable No public exploit Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
CVE-2026-25263 Medium 2026-10-06 Not applicable No public exploit Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
CVE-2026-78513 Medium 2026-09-08 Not applicable No public exploit Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-72977 Medium 2026-09-08 Not applicable No public exploit Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
CVE-2026-72975 Medium 2026-09-08 Not applicable No public exploit Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
CVE-2026-69690 Medium 2026-09-08 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-69636 Medium 2026-09-08 Not applicable No public exploit Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-69615 Medium 2026-09-08 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-69409 Medium 2026-09-08 Not applicable No public exploit Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-68809 Medium 2026-08-11 Not applicable No public exploit Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-64922 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-64916 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-64902 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-64897 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-63516 Medium 2026-08-11 Not applicable No public exploit Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-63512 Medium 2026-08-11 Not applicable No public exploit Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
CVE-2026-62917 Medium 2026-08-11 Not applicable No public exploit Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-62839 Medium 2026-08-11 Not applicable No public exploit Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-62837 Medium 2026-08-11 Not applicable No public exploit Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-62829 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-58639 Medium 2026-08-11 Not applicable No public exploit Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-54123 Medium 2026-08-11 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
CVE-2026-24077 Medium 2026-08-04 Not applicable No public exploit Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
CVE-2026-24076 Medium 2026-08-04 Not applicable No public exploit Memory Corruption when processing registry values with incorrect types using a direct query method.
CVE-2026-18085 Medium 2026-07-28 Not applicable No public exploit An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.
CVE-2026-21954 Medium 2026-07-21 No exploit published No public exploit Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is affected is 21.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-62826 Medium 2026-07-16 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-56192 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-56157 Medium 2026-07-14 Not applicable No public exploit Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-55142 Medium 2026-07-14 Not applicable No public exploit Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-55135 Medium 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-55124 Medium 2026-07-14 Not applicable No public exploit Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-55121 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-55051 Medium 2026-07-14 Not applicable No public exploit Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-55050 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-55047 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-55035 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-55030 Medium 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-55028 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-55027 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-55026 Medium 2026-07-14 Not applicable No public exploit Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-55023 Medium 2026-07-14 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-55020 Medium 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-55019 Medium 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-55016 Medium 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-54108 Medium 2026-07-14 Not applicable No public exploit External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-50657 Medium 2026-07-14 Not applicable No public exploit Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
CVE-2026-56152 Medium 2026-07-01 Not applicable No public exploit Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.
CVE-2026-48775 Medium 2026-06-16 Not applicable No public exploit LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time. This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime. This issue has been fixed in version 4.1.1.
CVE-2026-48562 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-48560 Medium 2026-06-09 Not applicable No public exploit Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-47641 Medium 2026-06-09 Not applicable No public exploit Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-47640 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-47639 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-47638 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-47637 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-47636 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45483 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-45479 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-45468 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-45467 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-45465 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45464 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45462 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-45453 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-44821 Medium 2026-06-09 Not applicable No public exploit Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-33113 Medium 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-59611 Medium 2026-06-01 Not applicable No public exploit Memory corruption in diagnostic services due to absence of input validation
CVE-2026-9035 Medium 2026-05-27 Not applicable No public exploit IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.
CVE-2026-8109 Medium 2026-05-12 Not applicable No public exploit An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.
CVE-2025-41011 Medium 2026-04-21 Not applicable No public exploit HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.
CVE-2026-32201 Medium 2026-04-14 Not applicable Exploited Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-20945 Medium 2026-04-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-39380 Medium 2026-04-07 Not applicable Proof of concept only Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied through the stock_location parameter, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. This vulnerability is fixed in 3.4.3.
CVE-2026-32712 Medium 2026-04-07 Not applicable Proof of concept only Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_name column is configured with escape: false in the bootstrap-table column configuration, causing customer names to be rendered as raw HTML. An attacker with customer management permissions can inject arbitrary JavaScript into a customer's first_name or last_name field, which executes in the browser of any user viewing the Daily Sales page. This vulnerability is fixed in 3.4.3.
CVE-2026-33730 Medium 2026-03-27 Not applicable Proof of concept only Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.
CVE-2026-3981 Medium 2026-03-12 Not applicable Proof of concept only A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0. Affected is an unknown function of the file /admin/doctor_action.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2026-3980 Medium 2026-03-12 Not applicable Proof of concept only A vulnerability has been found in itsourcecode Online Doctor Appointment System 1.0. This impacts an unknown function of the file /admin/patient_action.php. Such manipulation of the argument patient_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-14963 Medium 2026-02-24 Not applicable No public exploit A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver (BYOVD) was leveraged to gain access to the critical Windows process memory lsass.exe (Local Security Authority Subsystem Service). The fekern.sys is a driver file associated with the HX Agent (used in all existing HX Agent versions). The vulnerable driver installed in a product or a system running a fully functional HX Agent is, itself, not exploitable as the product’s tamper protection restricts the ability to communicate with the driver to only the Agent’s processes.
CVE-2026-26745 Medium 2026-02-20 Not applicable No public exploit OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.
CVE-2025-70095 Medium 2026-02-13 Not applicable Proof of concept only A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVE-2025-70094 Medium 2026-02-13 Not applicable Proof of concept only A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Category parameter.
CVE-2025-70091 Medium 2026-02-13 Not applicable Proof of concept only A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Phone Number parameter.
CVE-2025-70092 Medium 2026-02-12 Not applicable No public exploit A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter.
CVE-2026-1602 Medium 2026-02-10 Not applicable No public exploit SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-67263 Medium 2026-01-20 Not applicable Proof of concept only Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these fields, which, persisted in the database.
CVE-2025-67261 Medium 2026-01-20 Not applicable No public exploit Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page.
‹ prev page 1 of 10 next ›