HIGH Severity CVEs

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endp

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a s

A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to an

A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticat

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension componen

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new u

The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthen

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outp

A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the function formWlSiteSurvey of the

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns th

Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attacker

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config funct

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm

A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope conn->binding slowpath to bound sessio

A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the librar

A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function i

A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the

A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.s

A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the

A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in th

A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affecte

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file lite

AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php end

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authori

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because P

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attack

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion

Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows ap

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, whi

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org

Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3,

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream wi

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream c

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized atta

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an aut

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MC

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contai

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic e