HIGH Severity CVEs

WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitr

The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the pag

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with ac

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an

Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locall

The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publicatio

HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an a

Unauthorized users can access INFINITT PACS System Manager without proper authorization, which could lead to unauthoriz

Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnera

On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers

Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email

An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnera

A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown f

WeGIA is a Web manager for charitable institutions. Prior to 3.4.10, there is a SQL Injection vulnerability in the /html

A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the i

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPi

A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is

A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is

A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of t

A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParental

Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulner

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malf

vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Ser

A vulnerability was identified in PHPGurukul User Management System 1.0. This vulnerability affects unknown code of the

Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attacke

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers t

Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spher

A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPasseng

A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Exec

A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /go

The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2.

An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a mal

Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with cert

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast

A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.

A weakness has been identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0

A security flaw has been discovered in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/

A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0

A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0

A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002

A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.0

A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1

A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms al

Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru