HIGH Severity CVEs

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized

Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service o

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows a

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application

CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application deni

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an aut

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges loca

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged atta

Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker co

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged at

Improper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may al

Improper privilege management for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Proc

Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers m

Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may al

Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a deni

Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial

Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Softwar

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker wi

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the develop

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via loca

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code executio

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting parti

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltr

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JS

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getShee

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed S

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT perm

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, s

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes auth

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can cr

Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authentica

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated at

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF

Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerabili

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code ex

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Emai