2024

Ghostty is a cross-platform terminal emulator. Ghostty, as allowed by default in 1.0.0, allows attackers to modify the w

Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploy

path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the f

An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could pote

LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 con

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API f

Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An atta

LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnera

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains

In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker cou

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. The seed string

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. If an attacker

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR . An attacker

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, a

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, t

There is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.52

Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of

Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC)

Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffo

Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthent

Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-p

Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow

An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on t

Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input

A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. T

ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 t

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LD

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the l

Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fet

A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a b

A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 100

A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configur

pdftools is a high level tools to convert PDF files to ePUB formats. In versions up to and including 0.5.0 maliciously c

Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, s

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a pr

Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerabi

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnera

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWE

ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option t

Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby,

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer tha

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) v

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3

In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markd

The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS