2024

Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to ex

A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjans

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data

Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers t

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnera

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or co

BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote

luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path t

In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt i

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatG

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulner

Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In th

In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent co

TELSAT marKoni FM Transmitters are vulnerable to users gaining unauthorized access to sensitive information or performin

TELSAT marKoni FM Transmitters are vulnerable to an attacker bypassing authentication and gaining administrator privileg

TELSAT marKoni FM Transmitters are vulnerable to an attacker exploiting a hidden admin account that can be accessed thro

Authorization Bypass Through User-Controlled Key vulnerability in Talya Informatics Travel APPS allows Exploiting Incorr

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer ma

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability

Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Sessi

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 p

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par

Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may a

An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/adm

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subs

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the applica

An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

GigaDevice GD32E103C8T6 devices have Incorrect Access Control.

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely imp

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh

In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This v

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injectio

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or r

Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This i

Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue

In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws

In the Linux kernel, the following vulnerability has been resolved: Revert "xsk: Support redirect to any socket bound t

Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verificati

The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all v

Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A m

An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code exec

An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code ex

Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows

SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attacker