2025

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attac

Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitra

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitra

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use aft

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) a

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Bu

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to ins

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler G

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 1

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: be

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker

A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an atta

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 throu

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, mac

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Inst

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauth

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to exec

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote at

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker t

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to exec

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Ga

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vul

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual serv

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPad

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially expl