HIGH Severity CVEs

HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attack

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from t

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field f

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the P

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmwa

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document c

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Pri

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application o

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoiste

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependenc

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patch

ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attack

SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing appli

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken()

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote a

Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_

Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bi

Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P

Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient

Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, fr

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 t

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 t

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.1

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQ

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP c

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The came

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-qu

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Compone

Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS mess

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFrom

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component crea

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with sev

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP respo

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on t

Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attacker

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProce

The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before

The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management opera

The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea p

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registra

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value befo