2025

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance manageme

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisio

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Softwar

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Bu

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vul

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPad

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heap

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to a

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed an

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnera

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local at

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker wit

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to ex