MEDIUM Severity CVEs

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 pr

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitutio

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/en

The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php ma

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only re

The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SI

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by inc

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both

The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to ad

A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPath

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Docum

Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., L

Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access

Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of D

In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logi

In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-ze

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-ze

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table re

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the me

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resou

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured wit

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative

Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recur

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed

An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being se

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of bei

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a den

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix sleep-inside-lock in __smc_setsockopt(

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL-deref of opinfo->conn in oplock/lea

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: add mutex to guard hook refere

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context addres

In the Linux kernel, the following vulnerability has been resolved: devlink: Release nested relation on devlink free d

In the Linux kernel, the following vulnerability has been resolved: wifi: fix leak if split 6 GHz scanning fails rdev-

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: enforce HE/EHT cap/oper consistency

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_all

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not releasing hdev reference on

In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options T

In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pd

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in