2025

With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those

thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resour

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler o

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote u

Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier

Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows

The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak info

Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a cal

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5,

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from

LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1

PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the inpu

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the E

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPad

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is f

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in m

The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacke

With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy

Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with th

The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up

IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim.

Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linu

hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, th

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 3.7.0 to befo

Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflo

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to befo

Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a

A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries,

Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) ap

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session K

The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitra

The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage us

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise w

Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by def

The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly ve

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variat

Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploit

Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting In

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nel

Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Acces

Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Expl