HIGH Severity CVEs

An unauthenticated debug port may allow access to the device file system.

The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.

The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient

SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan f

Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck

The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and S

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords u

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan func

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment

Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cr

Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only withi

TP-Link AX1800 WiFi 6 Router (Archer AX21) devices allow unauthenticated attackers (on the LAN) to execute arbitrary cod

An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker

A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` fie

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and s

The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before usin

VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file,

VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted f

KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted fil

VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. If the product uses a specia

KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability. If the product uses a specially

KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangero

An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly ex

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been ident

OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a

NVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attac

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 throug

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 throug

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module con

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), Query

A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to caus

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The

A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to exe

A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2val

A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supp

In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.10

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fail

DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.