2025

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose informa

Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder w

Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacke

Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker

Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <=

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broads

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadLis

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetiz

Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of

Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to cond

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via ad

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via ad

Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conducto

A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attac

Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Control

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database packag

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested

A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana serve

A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to c

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to ve

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The b

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The E

Cursor is a code editor built for programming with AI. In versions 0.45.0 through 0.48.6, the Cursor app introduced a re

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an

A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject