2025

error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex w

color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account f

debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after

color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for col

color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-

simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken

hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting (XSS) vu

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server o

Vulnerability in SK Hynix DDR5 on x86 allows a local attacker to trigger Rowhammer bit flips impacting the Hardware Inte

A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page conta

An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the

A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a w

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a w

dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execu

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unex

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unex

Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the

matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `R

In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to dow

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protection

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive

Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Floodi

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.

The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hij

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion

DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this

Reflected Cross-Site Scripting (XSS) vulnerability in Azon Dominator. This vulnerability allows an attacker to execute J

Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive informa

It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Pas

It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to byp

A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which t

PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being ap

Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest we

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that c

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Nod

OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated a

Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin acc

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not c

Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affe

Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue aff

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CRESTRON TOUCHSCREENS x7