HIGH Severity CVEs

The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficien

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insuffic

The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficien

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insuffi

The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insuffici

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affe

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Ma

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. T

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gatew

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Manag

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the func

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref i

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function i

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a sha

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an In

Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (wi

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows u

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Sou

A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially

Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authen

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set wit

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response proces

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Co

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Co

SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause

The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up t

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3.

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAut

A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyactio

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspecialchars of the file

A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Di