HIGH Severity CVEs

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The

FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute

e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset p

A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.

A security flaw has been discovered in Das Parking Management System 停车场管理系统 6.2.0. This vulnerability affects unknown c

A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of

A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0.

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distribu

Karakeep is a elf-hostable bookmark-everything app. A Server-Side Request Forgery (SSRF) protection bypass vulnerability

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitra

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to exe

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmo

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers t

A vulnerability was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10. Affected by thi

When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to r

The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As

The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage o

An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating Syst

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability

MediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged

The affected product extracts installation files to a temporary directory with incorrect default permissions during admi

The affected product creates a directory with insecure default permissions during administrative installation. This allo

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha

Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the mid

A vulnerability was identified in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the fil

A vulnerability was found in itsourcecode Electronic Judging System 1.0. This vulnerability affects unknown code of the

A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /

A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar heade

A security vulnerability has been detected in fraillt bitsery up to 5.2.4. Affected is the function loadFromSharedState

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directo

A vulnerability was determined in hemant6488 CodeIgniter-StudentManagementSystem. The affected element is an unknown fun

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements

Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured

Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects

Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access

Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affe

Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascadi

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues o

Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) s

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query

A vulnerability has been found in Edimax EW-7438RPn 1.31. This impacts the function formSDHCP of the file /goform/formSD

A flaw has been found in Edimax EW-7438RPn 1.31. This affects the function formStats of the file /goform/formStats. This

A vulnerability was detected in Edimax EW-7438RPn 1.31. The impacted element is the function formrefresh of the file /go

A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The affected element is the function formLogout of

A vulnerability was found in yashpokharna2555 StudentManagementSystem up to cb2f558ddf8d19396de0f92abf2d224d46a0a203. Af