2024

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present

Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability

Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and

Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information v

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privile

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privile

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privile

Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page par

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a cra

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through t

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: WARN on vNMI + NMI window iff NMIs are ou

In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_it

In the Linux kernel, the following vulnerability has been resolved: media: mc: Fix graph walk in media_pipeline_start

In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Curre

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When both hwmon an

In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA te

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vma_add_reservation upon EN

In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the leg

KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via

The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed ea

supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.

An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x th

jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated u

Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice

Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice Core allows Reflected XSS.This issue affects Woffice Core:

Gogs through 0.13.0 allows argument injection during the tagging of a new release.

Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This

Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API

The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'u

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'u

Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-V

Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi E

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and i

A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is

In https://github.com/google/nftables  IP addresses were encoded in the wrong byte order, resulting in an nftables conf

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When proc

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution v

Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrar

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 o

Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the

Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an at

An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.

A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization

Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can u

Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacke

Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled,