2025

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any lo

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthe

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attac

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance manageme

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the ani

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modificat

A remote code execution issue exists in HPE OneView.

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of th

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perfor

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisio

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. Thi

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote cod

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vul

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corr

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized at

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to init

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and abov

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers

Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Ex

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows o

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local Fil

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Softwar

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secu

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Softwa

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corr

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code executi

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a