HIGH Severity CVEs

Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to

Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromis

Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary co

Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overf

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflo

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollm

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to i

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST A

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace

Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did n

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM managem

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22

Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Tra

Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Indus

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execut

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClien

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPip

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies wer

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated,

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/f

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine th

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Got

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI se

MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Fo

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly

Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack

Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebA

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP se

OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace del

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base:

Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as th

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lsee

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitra

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite loca

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to un