Checkmarx Zero

Disclosed Vulnerabilities

Checkmarx Zero is working on making the world a safer place by finding, disclosing, and helping to fix open-source vulnerabilities. Below are the vulnerabilities we’ve disclosed in our role as a CNA (CVE Numbering Authority) via the MITRE CVE process.

Our CVE disclosures

Sort by:

Name Vulnerability page

27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page

17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page

17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page

12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page

14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page

14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page

14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page

14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite_ip` Field 7.5 Visit the page

14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page

14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page

14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page

14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page

14 Nov 2024 CVE-2024-49764 Stored Cross-site Scripting in @LibreNMS/LibreNMS Capture Debug Information 7.5 Visit the page

14 Nov 2024 CVE-2024-49759 Stored Cross-site Scripting in @LibreNMS/LibreNMS Manage User Access 7.5 Visit the page

21 Oct 2024 CVE-2023-49089 Path Traversal on Package Name in @umbraco/Umbraco-CMS 6.5 Visit the page

1 Oct 2024 CVE-2024-47527 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Dependencies 7.5 Visit the page

1 Oct 2024 CVE-2024-47526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Alert Templates 3.5 Visit the page

1 Oct 2024 CVE-2024-47525 Stored Cross-site Scripting in @LibreNMS/LibreNMS Alert Rules 7.5 Visit the page

1 Oct 2024 CVE-2024-47523 Stored Cross-site Scripting in @LibreNMS/LibreNMS Alert Transports 7.5 Visit the page

23 Sep 2024 CVE-2024-35240 Stored XSS on Print Functionality in Umbraco Commerce 5.4 Visit the page

23 Sep 2024 CVE-2024-35239 Stored XSS on Title and Description Component of Umbraco Forms 2.7 Visit the page

23 Sep 2024 CVE-2024-35218 Stored XSS on Content Page Through Markdown Editor Preview Pane in @umbraco/Umbraco-CMS 4.2 Visit the page

23 Sep 2024 CVE-2023-48313 DOM-XSS in Login Functionality in @umbraco/Umbraco-CMS 4.3 Visit the page

14 Jun 2024 CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it 7.6 Visit the page

10 May 2024 CVE-2024-34349 Stored Cross-Site Scripting (XSS) in sylius/sylius 4.8 Visit the page

29 Apr 2024 CVE-2024-4068 Memory Exhaustion in braces 7.5 Visit the page

28 Apr 2024 CVE-2024-4067 Regular Expression Denial of Service (ReDoS) in micromatch 7.5 Visit the page

4 Apr 2024 CVE-2024-31217 Denial-of-Service via Improper Exception Handling in @strapi/plugin-upload 5.3 Visit the page

2 Jan 2024 CVE-2023-50447 Arbitrary Code Execution in Pillow 9 Visit the page

26 Sep 2023 CVE-2023-46495 Reflected XSS in Front Store in @evershop/evershop 6.1 Visit the page

25 Sep 2023 CVE-2023-46493 Directories List (via Relative Path Traversal) in @evershop/evershop 4.9 Visit the page

25 Sep 2023 CVE-2023-46498 Broken Function Level Authorization in @evershop/evershop 9.1 Visit the page

25 Sep 2023 CVE-2023-46497 Arbitrary Folder Creation (via Relative Path Traversal) in @evershop/evershop 4.1 Visit the page

25 Sep 2023 CVE-2023-46496 Arbitrary File Deletion (via Relative Path Traversal) in @evershop/evershop 8.7 Visit the page

25 Aug 2023 CVE-2023-46943 Insecure JWT – Hardcoded HMAC Secret in @evershop/evershop 9.1 Visit the page

25 Aug 2023 CVE-2023-46942 Lack of Authentication on GraphQL Endpoints in @evershop/evershop 7.5 Visit the page

1 Jul 2023 CVE-2023-44271 Denial of Service (DoS) in Pillow 7.5 Visit the page

27 Apr 2023 CVE-2023-46499 Stored XSS in Admin Panel in @evershop/evershop 9.3 Visit the page

27 Apr 2023 CVE-2023-46494 Reflected XSS in Admin Panel in @evershop/evershop 6.1 Visit the page

30 Oct 2022 CVE-2022-44143 Arbitrary File Write (via Path Traversal) in nopCommerce 5.8 Visit the page

12 Sep 2022 CVE-2022-2217 Cross-site Scripting (XSS) in parse-url 6.1 Visit the page

12 Sep 2022 CVE-2022-1996 Authorization Bypass Through User-Controlled Key in emicklei/go-restful. 9.1 Visit the page

12 Sep 2022 No CVE ReDoS vulnerability in GitPython 4.2 Visit the page

12 Sep 2022 CVE-2022-29858 Cross-Site Scripting in silverstripe/silverstripe-assets 4.3 Visit the page

12 Sep 2022 CVE-2022-28803 Stored XSS in silverstripe/silverstripe-framework 5.4 Visit the page

12 Sep 2022 CVE-2022-31043 Failure to strip Authentication header on HTTP downgrade in guzzle/guzzle 7.5 Visit the page

12 Sep 2022 CVE-2022-31042 Unvalidated Follow Redirects in guzzle/guzzle 7.5 Visit the page

12 Sep 2022 CVE-2022-29248 Set cookie for different domain in guzzle/guzzle 8.1 Visit the page

12 Sep 2022 No CVE Whitelist bypasses in parse-url 5.3 Visit the page

12 Sep 2022 No CVE Open Redirect in parse-url 5.3 Visit the page

12 Sep 2022 No CVE Hostname Spoofing via Improper Input Validation in parse-url 7.5 Visit the page

12 Sep 2022 No CVE Improper Input Validation in parse-url 6.5 Visit the page

12 Sep 2022 No CVE Exposure of Sensitive Information to an Unauthorized Actor in parse-url 7.5 Visit the page

12 Sep 2022 No CVE Authentication Bypass by Primary Weakness in parse-url 9.1 Visit the page

12 Sep 2022 CVE-2022-1537 Arbitrary File Write gruntjs/grunt 7 Visit the page

12 Sep 2022 CVE-2022-0436 Path Traversal in gruntjs/grunt 5.5 Visit the page

21 Jul 2022 CVE-2022-2216 SSRF via Improper Input Validation in ionicabizau/parse-url 9.8 Visit the page

21 Jul 2022 CVE-2022-2218 Cross Site Scripting in ionicabizau/parse-url 6.1 Visit the page

21 Jul 2022 CVE-2022-31091 Sensitive header uncleared on same-host, cross-port redirect in guzzle/guzzle 7.7 Visit the page

20 Jul 2022 No CVE Authenticated RCE in craftcms/cms 7.2 Visit the page

17 Jun 2022 No CVE Unintended function invocation in Spring Cloud Function 6.5 Visit the page

17 Jun 2022 CVE-2022-22979 DoS in Spring Cloud Function 7.5 Visit the page

28 Apr 2022 No CVE Log Injection in loguru 7.5 Visit the page

28 Apr 2022 CVE-2022-0338 Improper Privilege Management in Conda 'loguru' 4.3 Visit the page

28 Apr 2022 No CVE A ReDoS (Regular Expression Denial of Service) vulnerability in GitPython 4.2 Visit the page

28 Apr 2022 CVE-2022-0227 Business Logic Errors in SilverStripe Framework 4.3 Visit the page

28 Apr 2022 CVE-2022-0691 Authorization Bypass vulnerability in url-parse 9.8 Visit the page

28 Apr 2022 CVE-2022-0686 Authorization Bypass vulnerability in url-parse 9.1 Visit the page

25 Apr 2022 CVE-2022-0639 Authorization Bypass vulnerability in url-parse 5.3 Visit the page

25 Apr 2022 CVE-2022-0512 Authorization Bypass vulnerability in url-parse 5.3 Visit the page

25 Apr 2022 CVE-2021-43432 XSS in XMALL ecommerce system 6.1 Visit the page

15 Jan 2022 No CVE Improper Restriction of XML External Entity Reference in jetbrains/kotlin 8.2 Visit the page

30 Dec 2021 CVE-2021-44832 Deserialization attack via JDBC Appender in log4j 6.6 Visit the page

19 Sep 2021 CVE-2021-37794 Stored XSS Vulnerability Discovered in FileBrowser 9 Visit the page

1 Sep 2021 No CVE Command injection vulnerability in ssh2 9.8 Visit the page

1 Sep 2021 CVE-2021-33360 Command injection vulnerability in @stoqey/gnuplot 9.8 Visit the page

22 Jul 2021 CVE-2021-37367 Code Execution Vulnerability Discovered in CTparetnal 7.8 Visit the page

14 Jul 2021 CVE-2021-37366 CSRF Vulnerability Discovered in CTparetnal 8.8 Visit the page

14 Jul 2021 CVE-2021-37365 Reflected XSS Vulnerability Discovered in CTparetnal 6.1 Visit the page

29 Jun 2021 No CVE Command injection vulnerability in coveralls 9.3 Visit the page

28 Jun 2021 CVE-2021-36517 Prototype pollution in extend2 5.6 Visit the page

28 Jun 2021 CVE-2021-36518 Prototype pollution in cloneextend 5.6 Visit the page

22 Jun 2021 CVE-2021-34826 SQL Injection in Heimdall Gateway - heimdall/getheimdall 9.8 Visit the page

21 Jun 2021 CVE-2021-33359 Arbitrary File Read Vulnerability Discovered in GoWitness 9.8 Visit the page

21 Jun 2021 CVE-2021-33358 Authenticated Command Injection Vulnerability Discovered in RaspAP 9.9 Visit the page

21 Jun 2021 CVE-2021-33357 Unauthenticated Command Injection Vulnerability Discovered in RaspAP 10 Visit the page

21 Jun 2021 CVE-2021-33356 Privilege Escalation Vulnerability Discovered in RaspAP 9.9 Visit the page

21 Jun 2021 CVE-2021-31800 Path Traversal Vulnerability Discovered in Impacket 9.9 Visit the page

14 Jun 2021 CVE-2021-33829 Stored XSS Vulnerability Discovered in CKEditor4 6.1 Visit the page

4 Jun 2021 CVE-2021-25641 Unsafe Deserialization In Apache Dubbo & Alibaba Dubbo 10 Visit the page

17 May 2021 CVE-2021-33420 Deserialization RCE attack in replicator 9.8 Visit the page

5 May 2021 CVE-2021-29369 Command Injection in @rkesters/gnuplot 9.8 Visit the page

29 Apr 2021 CVE-2021-26543 Command injection vulnerability in git-parse 9.8 Visit the page

28 Apr 2021 No CVE Gnuplot Command Injection in plotframes 9.8 Visit the page

28 Apr 2021 No CVE OS Command Injection in plotter 9.8 Visit the page

28 Apr 2021 No CVE Gnuplot Command Injection in gnu-plot 9.8 Visit the page

28 Apr 2021 No CVE Command Injection in docker-tester 9.8 Visit the page

28 Apr 2021 No CVE Command injection vulnerability in lifion-verify-deps 7.5 Visit the page

28 Apr 2021 No CVE Command Injection in jandoc 9.8 Visit the page

28 Apr 2021 No CVE Command Injection in gnuplot-heatmap 9.8 Visit the page

27 Apr 2021 No CVE Command Injection in azure-gs 5.5 Visit the page

27 Apr 2021 No CVE Command injection vulnerability in the ssl-utils NPM package 9.8 Visit the page

26 Apr 2021 No CVE OS Command Injection in ebook 9.8 Visit the page

26 Apr 2021 No CVE Command injection vulnerability in the proctree NPM package 7.2 Visit the page

26 Apr 2021 No CVE Command injection vulnerability in the gitsome NPM package 7.5 Visit the page

26 Apr 2021 CVE-2021-31896 Command injection vulnerability in curl-ganteng 9.8 Visit the page

26 Apr 2021 No CVE Remote code execution vulnerability in reqwest 9.8 Visit the page

26 Apr 2021 No CVE Command injection vulnerability in the google-it NPM package 7.5 Visit the page

25 Apr 2021 No CVE Command injection vulnerability in s3-uploader 9.8 Visit the page

23 Mar 2021 CVE-2021-29300 Command injection vulnerability in @ronomon/opened 9.8 Visit the page

28 Feb 2021 CVE-2021-26540 Validation Bypass in sanitize-html using protocol relative URLs 5.3 Visit the page

28 Feb 2021 CVE-2021-26539 Validation Bypass in sanitize-html using IDN 5.3 Visit the page

18 Feb 2021 CVE-2021-27515 Hostname spoofing in url-parse 7.5 Visit the page

13 Feb 2021 CVE-2021-27516 Hostname spoofing in urijs 7.5 Visit the page

10 Feb 2021 CVE-2021-27191 Denial of Service in get-ip-range package 7.5 Visit the page

9 Feb 2021 CVE-2021-27185 Command injection vulnerability in samba-client 9.8 Visit the page

9 Feb 2021 CVE-2020-28997 Local File Inclusion vulnerabilities in Pixel Caffeine Wordpress plugin 8.2 Visit the page

1 Feb 2021 CVE-2021-23980 Mutation XSS in Mozilla-bleach using comments 6.1 Visit the page

21 Jan 2021 CVE-2021-26275 Command injection vulnerability in the eslint-fixer NPM package 7.2 Visit the page

21 Jan 2021 CVE-2021-26276 Command injection vulnerability in the config-shield NPM package 5.3 Visit the page

20 Jan 2021 CVE-2021-3190 Command injection vulnerability in async-git 9.8 Visit the page

14 Jan 2021 CVE-2021-3133 CSRF in Elementor-Contact-Form-DB wordpress plugin 8.8 Visit the page

11 Jan 2021 CVE-2021-23326 Command injection vulnerability in @graphql-tools/git-loader 9.8 Visit the page

6 Jan 2021 CVE-2021-26541 Command injection vulnerability in gitlog 9.8 Visit the page

6 Jan 2021 CVE-2020-35774 Stored XSS via /histogram endpoint in twitter-server 6.1 Visit the page

23 Dec 2020 CVE-2020-35773 RCE via site-offline wordpress plugin 6.5 Visit the page

17 Dec 2020 CVE-2020-26275 Open redirect in Jupyter server 6.1 Visit the page

8 Dec 2020 CVE-2020-35135 CSRF in ultimate-category-excluder wordpress plugin 8.8 Visit the page

2 Dec 2020 CVE-2020-13669 XSS in Drupal core's built-in CKEditor image caption functionality 6.1 Visit the page

30 Nov 2020 CVE-2020-28996 CSRF and Reflected XSS in PowerPress Wordpress plugin 8.2 Visit the page

27 Nov 2020 CVE-2020-27783 Mutation Cross-Site Scripting in lxml 6.1 Visit the page

19 Nov 2020 CVE-2020-13663 Reflected DOM-based XSS in Drupal Core 6.1 Visit the page

18 Nov 2020 No CVE Reintroduced ReDoS in debug 5.3 Visit the page

17 Nov 2020 CVE-2020-13942 Remote Code Execution in Apache Unomi using `MVEL` and `OGNL` expressions 9.8 Visit the page

16 Nov 2020 CVE-2020-28995 Reflected XSS in Paid Memberships Pro Wordpress plugin 8.2 Visit the page

8 Nov 2020 CVE-2020-15275 XSS in MoinMoin when uploading a SVG file with malicious javascript code in its content 8.7 Visit the page

10 Oct 2020 CVE-2020-26935 SQL Injection in phpMyAdmin 6.1 Visit the page

20 Aug 2020 CVE-2020-14044 Codiad SSRF when installing a plugin 7.2 Visit the page

20 Aug 2020 CVE-2020-14043 Codiad CSRF in the plugin request 8.8 Visit the page

20 Aug 2020 CVE-2020-14042 Stored XSS via folder name in Codiad 6.1 Visit the page

22 Apr 2020 CVE-2020-7598 Prototype Pollution vulnerability in Minimist 5.6 Visit the page

17 Mar 2020 CVE-2020-6816 Mutation XSS in Mozilla-bleach via svg or math 6.1 Visit the page

25 Feb 2020 CVE-2020-6802 Mutation XSS in Mozilla-bleach via noscript 6.1 Visit the page

16 Feb 2020 No CVE Open redirect in macaron/i18n 6.1 Visit the page

10 Feb 2020 CVE-2019-17564 Unsafe deserialization in Apache Dubbo 9.8 Visit the page

26 Sep 2019 No CVE OS command execution vulnerability in Commander.js 4.5 Visit the page

31 Jan 2019 CVE-2019-3826 DOM XSS in Prometheus 6.1 Visit the page

31 Jan 2019 No CVE Open redirect in gitea/blog 6.1 Visit the page

13 Dec 2017 CVE-2016-10703 Denial of Service (DoS) vulnerability in ecstatic npm package 7.5 Visit the page

17 Nov 2017 CVE-2017-14077 HTML injection in Securimage 6.1 Visit the page

18 May 2016 CVE-2016-10510 Cross-Site Scripting in Kohana PHP 6.1 Visit the page

Disclosed Vulnerabilities

Stay connected and never miss a research update!