2025

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could l

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heap

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer

Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privi

Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges l

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attac

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms all

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to a

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCa

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious c

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed an

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the S

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the C

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By us

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. Accordi

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from vers

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated a

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent insta

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a sp

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and O

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Seq

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regres

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrar

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arb

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server com

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server pas

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 thr

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnera

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local at

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature loc

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.