Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2024-12125
High · 7.5
CWE-281 Nov 6, 2025
3scale-porta: readonly fields not validated server-side
A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.
CVE-2025-37735
High · 7.0
CWE-281 Nov 6, 2025
Improper preservation of permissions in Elastic Defend on Windows hosts can lead to…
Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.
CVE-2025-34298
High · 8.8
CWE-281 Oct 30, 2025
Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation
Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.
CVE-2023-32199
Medium · 4.3
CWE-281 Oct 29, 2025
Rancher user retains access to clusters despite Global Role removal
A vulnerability has been identified within Rancher
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding binding, the user still
retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs
CVE-2017-8543
Critical · 9.8
KEV High · 69 Public exploit CWE-281 Jun 14, 2017
Microsoft Windows Search Remote Code Execution Vulnerability
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".