2025

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: do not repeat pte_offset_map_lock()

In the Linux kernel, the following vulnerability has been resolved: pidfs: validate extensible ioctls Validate extensi

## Summary Authenticated SQL Injection Vulnerability in Endpoint Module Rest API

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability i

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contai

Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZi

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of

A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed e

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authenticatio

JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Wi

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even

Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not res

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high

Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Dat

KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platf

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private

Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directo

Reflected Cross-site Scripting (XSS) vulnerability in Sanoma's Clickedu. This vulnerability allows an attacker to execut

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not exp

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service

Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully ex

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges

Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell comman

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlP

Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial

A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The dev

A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed

The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affec

The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/

Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnera

BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP

ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi351

Tellion HN-2204AP routers contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/system_confi

Dongyoung Media DM-AP240T/W wireless access points contain an unauthenticated configuration disclosure vulnerability in

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This all

The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control.

CMService.exe creates the C:\\usr directory and subdirectories with insecure permissions, granting write access to all a

The CMService.exe service runs with SYSTEM privileges and contains an unquoted service path. This allows a local attacke

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability

Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UA

Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a p

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiab

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiab

Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found i

UnForm Server versions < 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Do

SiRcom SMART Alert (SiSA) allows unauthorized access to backend APIs. This allows an unauthenticated attacker to bypass

A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could expl