CWE-425

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testin

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/updat

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From ve

OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access

ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user,

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.1

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not p

OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the

A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vuln

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the fil

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/f

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does no

A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function

Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db

A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the f

A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the f

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabi

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper a

Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges

HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware.

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an admini

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not pr