2025

An OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited, an arbitrary OS comman

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user rec

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.

Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create

A vulnerability was found in 1000 Projects Online Notice Board 1.0 and classified as critical. This issue affects some u

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown

A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part o

Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability. A local attacker could exploit this issue t

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 1

MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a ch

An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly chec

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deser

maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.

Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Des

tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix uninitialized memcache pointer in u

Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.

Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted paramete

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea a

Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof o

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2.

Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can uploa

A vulnerability was found in SourceCodester Client Database Management System 1.0. It has been declared as critical. Thi

A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affecte

A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0. This vulnerability affects unknown code

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the impro

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versio

An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 th

The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validati

Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'su

Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit h

An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbit

ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged

A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been declared as critical. This vulnerability af