HIGH Severity CVEs

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom

Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicControll

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint acce

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' e

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only w

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whethe

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the Signal

Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Se

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from

A security flaw has been discovered in Trendnet TEW-657BRM 1.00.1. The impacted element is the function update_pcdb of t

A vulnerability was identified in Trendnet TEW-657BRM 1.00.1. The affected element is the function add_apcdb of the file

An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in lib

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows

A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE paramet

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE paramet

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE paramet

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE paramet

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE paramet

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE paramet

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE paramet

Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handl

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic config

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations

Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a p

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation

Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, there is a quadratic complexi

A weakness has been identified in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file

A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown pro

In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may cr

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, th

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause S

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, inefficiency in KRB5 buffering can le

Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule ke

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, th

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, mu

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) po

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace iso

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass

In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and

In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait()

In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu

Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via mul