2025

An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated att

A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vul

A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnera

An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerabil

An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effe

A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigge

A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact

A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Ter

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can

Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js appl

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions

Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php.

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large n

iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via c

Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve pers

Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images

Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not pro

A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, ca

A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML,

An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would exe

A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Applicati

FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthentica

The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State

The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-sec

thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resour

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and

LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1

PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the inpu

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the E

Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned

Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the

In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpi_video_switc

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak of qgroup_list in btrfs_add_

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writ

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_mo

BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize in

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice wh

An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email addr

Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in opentext uC

Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac

eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and relate

eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vuln

The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connecti

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers,

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers,

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload d

Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may all