HIGH Severity CVEs

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapte

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malici

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypass

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary co

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated lo

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, a

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 1

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded f

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Lo

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacki

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An a

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed atta

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation di

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all version

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to v

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenti

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privile

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, P

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior t

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handli

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SS

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and serv

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabl

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecke

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal as

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.2

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote pee

Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic

TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote a

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a ma

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious br

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypas

A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with a

A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a l

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenti

A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was a