HIGH Severity CVEs

An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive informati

An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service

Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an S

A flaw has been found in Tenda AX1803 1.0.0.1. The affected element is the function fromGetWifiGuestBasic of the file /g

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the fil

A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this iss

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 1

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows s

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 1

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 1

Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows Fi

Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows E

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart

Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Educatio

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Info

MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote at

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has

Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versi

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature mal

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature for

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, a

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attac

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic f

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilit

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versio

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0

Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to versio

Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes`

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates

EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors

D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When ex

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints.

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticat

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

OKI Print Job Accounting 4.4.10 contains an unquoted service path vulnerability in the OkiJaSvc service that allows loca

Pingzapper 2.3.1 contains an unquoted service path vulnerability in the PingzapperSvc service that allows local attacker

OKI Configuration Tool 1.6.53 contains an unquoted service path vulnerability in the OKI Local Port Manager service that