2025

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. Thi

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from

The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When th

An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return s

An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Servi

An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Servi

Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payload

Captive Portal can expose sensitive information

Captive Portal can allow authentication bypass

Diagnostics command injection vulnerability

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.

Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file locat

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause uninitiali

NVIDIA Project G-Assist contains a vulnerability where an attacker might be able to escalate permissions. A successful e

NVIDIA Display Driver for Windows and Linux contains a vulnerability in a video decoder, where an attacker might cause a

NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger

NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to trigger a null pointer deref

NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer d

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the co

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local

gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.ph

A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers

Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute ar

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authenticati

Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /c

Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authen

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of th

OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is v

FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.

Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.

FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.

Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue af

A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attack

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attacker

Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take

Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near t

CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding addi

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the

Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA

A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built wi

Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same l

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS (Cross-site Scripting) attacks, because parameters in GET re

An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switch

Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attac

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘a

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is

Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in