HIGH Severity CVEs

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libf

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libf

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflo

A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is the function formCreateFileName of the file /goform/crea

Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that c

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to

Gotenberg is an API for converting document formats. Prior to version 8.29.0, the fix introduced for CVE-2024-21527 can

A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown proce

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `_

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin

Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 M

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is abl

Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the a

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when convertin

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Di

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerabl

OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing th

Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows u

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the mysqlColumnAsInsert function in file pl

CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validati

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability e

Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows attackers to crash the service by supplyin

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer

The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticate

Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is ena

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version

An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their i

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 1

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or rej

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in th

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via s

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExt

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/W

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pai

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authentica

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local u

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-sec

OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local cod

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable f

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationT

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only oper