https://vulnogram.org/ Most recent CVEs assigned by Checkmarx (checkmarx). https://vulnogram.org/seaview/icons/checkmarx.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-109449 https://vulnogram.org/CVE-2026-109449 In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, arra… High Network Exploitable Thu, 15 Oct 2026 15:19:08 GMT https://vulnogram.org/CVE-2026-109413 https://vulnogram.org/CVE-2026-109413 In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the… High Network Exploitable Thu, 15 Oct 2026 14:57:00 GMT https://vulnogram.org/CVE-2026-108082 https://vulnogram.org/CVE-2026-108082 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched white… High Network Exploitable Thu, 15 Oct 2026 14:46:01 GMT https://vulnogram.org/CVE-2026-9591 https://vulnogram.org/CVE-2026-9591 Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due t… Medium Network Exploitable Wed, 17 Jun 2026 13:41:49 GMT https://vulnogram.org/CVE-2026-11975 https://vulnogram.org/CVE-2026-11975 Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sani… Medium Wed, 17 Jun 2026 12:18:28 GMT https://vulnogram.org/CVE-2014-125128 https://vulnogram.org/CVE-2014-125128 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (`<a>`), allowing bypasses that contain different casings, w… Medium Network Exploitable Mon, 08 Sep 2025 10:09:25 GMT https://vulnogram.org/CVE-2019-25225 https://vulnogram.org/CVE-2019-25225 `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values… Medium Network Exploitable Mon, 08 Sep 2025 10:02:42 GMT https://vulnogram.org/CVE-2014-125127 https://vulnogram.org/CVE-2014-125127 The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HT… High Network Exploitable Wed, 03 Sep 2025 08:35:05 GMT https://vulnogram.org/CVE-2025-6050 https://vulnogram.org/CVE-2025-6050 Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before in… Medium Tue, 17 Jun 2025 11:06:12 GMT https://vulnogram.org/CVE-2018-25110 https://vulnogram.org/CVE-2018-25110 Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerab… Medium Network Exploitable Fri, 23 May 2025 14:53:43 GMT https://vulnogram.org/CVE-2025-0825 https://vulnogram.org/CVE-2025-0825 cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more. Medium Network Exploitable Tue, 04 Feb 2025 14:11:51 GMT https://vulnogram.org/CVE-2024-8374 https://vulnogram.org/CVE-2024-8374 UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerability arises from improper handling of the drop_to_buildplate property within 3MF files, whi… High Tue, 03 Sep 2024 10:01:12 GMT https://vulnogram.org/CVE-2024-5685 https://vulnogram.org/CVE-2024-5685 Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1. High Fri, 14 Jun 2024 09:54:41 GMT https://vulnogram.org/CVE-2024-4068 https://vulnogram.org/CVE-2024-4068 The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop,… High Network Exploitable Mon, 13 May 2024 10:06:38 GMT https://vulnogram.org/CVE-2024-4067 https://vulnogram.org/CVE-2024-4067 The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious p… Medium Network Exploitable Mon, 13 May 2024 10:04:42 GMT