HIGH Severity CVEs

Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly Constrai

Missing Authorization vulnerability in spider-themes EazyDocs allows Exploiting Incorrectly Configured Access Control Se

Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Bloc

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality No

Missing Authorization vulnerability in Hercules Design Hercules Core allows Exploiting Incorrectly Configured Access Con

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishLi

Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Acce

Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafte

An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Co

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator inter

NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker ma

NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privi

Stack-based buffer overflow vulnerability exists in multiple laser printers and MFPs which implement Ricoh Web Image Mon

A vulnerability was found in code-projects Courier Management System 1.0. It has been rated as critical. This issue affe

A vulnerability was found in code-projects Courier Management System 1.0. It has been declared as critical. This vulnera

A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.6. Affected is an unknown functi

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.p

An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via

An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until compl

An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file c

An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the C

An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Manage

An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove fun

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a den

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary comm

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the inse

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects a

A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentio

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intent

An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an

An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have

The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deploy

Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote

Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote atta

SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to e

Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Exe

http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter.

D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly

Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Exec

A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbit

An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files with

KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local netw

The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 f

The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions

EnGenius EnStation5-AC A8J-ENS500AC 1.0.0 devices allow blind OS command injection via shell metacharacters in the Ping