2025

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthe

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the ani

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perfor

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. Thi

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote cod

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vul

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corr

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized at

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and abov

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows o

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local Fil

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Softwa

Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitra

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitra

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use aft

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: be

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 throu

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, mac

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Inst

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote at

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker t

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual serv

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially expl

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer