2024

User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a W

Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks

Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks

openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-25

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular exp

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient ver

The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A se

The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vu

User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Display

This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without pro

This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upg

This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the devic

User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Sp

ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Z

A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dap

The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that c

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacke

Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DW

Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast rece

User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displaye

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authent

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user

The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malic

SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for

A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim

Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can imperso

PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensiti

An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required

Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is

@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerabl

vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, F

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI in

A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across mu

The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameter

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in

Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render hal

editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing).

Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on

Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive

Improper control of framework service permissions with possibility of some sensitive device information leakage.

The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` w

: Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This is

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azur

A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when vis

An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Q

Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Esc