CVE Watch
Every published CVE, mapped to engagement reality.
Crawled from cve.org every day. Each entry annotated with the QSearch coverage signal — how many of our agents, skills, and playbooks address the technique. Subscribe via RSS for SIEM pipe, or get the weekly digest by email.
Kiteworks is a private data network (PDN)
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
accellionCWE-639Kiteworks is a private data network (PDN)
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
accellionCWE-79Kiteworks is a private data network (PDN)
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
accellionCWE-639A security vulnerability has been detected in SGLang 0.5.10.post1
A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
CWE-617A weakness has been identified in code-projects Online Hospital Management System 1.0
A weakness has been identified in code-projects Online Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. This manipulation of the argument delid causes improper control of resource identifiers. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CWE-99A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2
A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper_model_load of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CWE-404CWE-476A vulnerability was identified in itsourcecode Fees Management System 1.0
A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown part of the file /manage_course.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CWE-74CWE-89A vulnerability was determined in itsourcecode Fees Management System 1.0
A vulnerability was determined in itsourcecode Fees Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CWE-74CWE-89A vulnerability was found in SourceCodester Customer Review App 1.0
A vulnerability was found in SourceCodester Customer Review App 1.0. Affected by this vulnerability is the function add_review/save_review/get_all_reviews of the file review_app.py. Performing a manipulation of the argument name/comment results in denial of service. The attack requires a local approach. The exploit has been made public and could be used.
CWE-404Memory Corruption when sending random number generator command with insufficient output buffer size
Memory Corruption when sending random number generator command with insufficient output buffer size.
qualcommCWE-787Memory Corruption when output buffer size is smaller than input buffer size during data copying operation
Memory Corruption when output buffer size is smaller than input buffer size during data copying operation.
qualcommCWE-121Memory corruption in windows drivers while sending incorrect trusted application request
Memory corruption in windows drivers while sending incorrect trusted application request
qualcommCWE-121Memory corruption in diagnostic services due to absence of input validation
Memory corruption in diagnostic services due to absence of input validation
qualcommCWE-787Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer
Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.
qualcommCWE-367Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
qualcommCWE-126Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device...
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.
qualcommCWE-1230In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
googleCWE-269In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in th...
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local with null execution privileges needed. User interaction is null for exploitation.
googleCWE-476In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation
In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
googleCWE-20A vulnerability has been found in PackageKit up to 1.3.5
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CWE-266CWE-285
5.4 MEDIUM
3.7 LOWWeekly digest
Get the curated CVE digest every Monday
One email a week, sent Monday morning CET. The CVEs published or modified in the last seven days, severity-ordered, with the QSearch coverage signal. Unsubscribe with one click — included in every send.
Pipe the CVE feed into your stack.
CVE Watch publishes RSS, Atom, and JSON feeds — wire them into your SIEM, Slack, Discord, or your RSS reader of choice. Or get the curated weekly digest by email.