HIGH Severity CVEs

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactur

An image with a version lower than the fuse version may potentially be booted lead to improper authentication.

A race condition exists in a driver potentially leading to a use-after-free condition.

Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW

Initial xbl_sec revision does not have all the debug policy features and critical checks.

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via S

Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead

Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction pr

The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More

Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction

Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for th

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugi

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an auth

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to re

Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Atte

Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability

The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data

IBM Data Virtualization Manager for z/OS 1.1 and 1.2 could allow an authenticated user to inject malicious JDBC URL para

@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend cl

A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote

In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and d

In the Linux kernel, the following vulnerability has been resolved: bpf: Check validity of link->type in bpf_link_show_

In the Linux kernel, the following vulnerability has been resolved: drm/xe/ufence: Prefetch ufence addr to catch bogus

In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behavio

Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before

The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client va

The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform

An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before 24.04.2, 23.10.x before

An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 2

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be

There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large a

A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the funct

A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an u

A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vu

A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This

A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0.

In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It

A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in hardy-barth cph2_ec

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic templ

A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is

The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotat

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing f

The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to

The WP-Orphanage Extended plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in