HIGH Severity CVEs

An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier. Opening sp

An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially

An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier. Opening sp

An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is_motion_tween of V-SFT v6.2.7.0 and earlier. Open

An out-of-bounds write vulnerability exists in VS6ComFile!set_AnimationItem of V-SFT v6.2.7.0 and earlier. Opening speci

An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlie

A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earl

The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter,

The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued

Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0

Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data.

Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to rep

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access se

Improper access control in Routines prior to version 4.8.7.1 in Android 15 and 4.9.6.0 in Android 16 allows local attack

Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across mult

pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web inte

BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 a

BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 a

The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient

Redis Enterprise Elevation of Privilege Vulnerability

Azure PlayFab Elevation of Privilege Vulnerability

Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrar

A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/us

A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown process

A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /us

A vulnerability was detected in Campcodes Online Learning Management System 1.0. This affects an unknown part of the fil

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. An authenticate

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a St

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® softwar

An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of servic

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Ne

A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local Fil

D-Link DIR-816A2_FWv1.10CNB05 was discovered to contain a stack overflow via the statuscheckpppoeuser parameter in the d

An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos Space Sec

A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated ne

A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4

A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allow

Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCISer

Use of an insecure temporary directory in the Windows License plugin for the Checkmk Windows Agent allows Privilege Esca

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted databas

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems.

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_li

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix untrusted unsigned subtract Fix the fol

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase p

In the Linux kernel, the following vulnerability has been resolved: gpiolib: acpi: initialize acpi_gpio_info struct Si