HIGH Severity CVEs

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specia

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote co

Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd prot

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.25

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.26

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.1

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) mi

Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to cra

Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, om

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, Es

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: thr

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manag

A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could a

A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticate

libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially craf

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PO

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ag

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrar

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values dir

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to

Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows

Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry

Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code th

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metach

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabas

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio a

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.too

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.too

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a cus

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL state

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks m

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile()

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vul