HIGH Severity CVEs

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS S

YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a

Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat:

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomca

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat:

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing compone

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClassifier

The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() meth

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoi

The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370

The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pand

Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This i

An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a c

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attack

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenti

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with

A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclo

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, Th

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature acc

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNE

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgr

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Trave

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elemento

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR wo

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExpe

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPF

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms V

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an uninte

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry an

[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/f

[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/f

[email protected] and lower versions are vulnerable to denial of service via regular expression backtracking in the Conte