2025

The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographical

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbi

Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attack

In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000,

In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix memory leak by freeing untracked p

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Mark invalid entities with id UVC_

In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: audioreach: fix potential null pointer

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix warning in smc_rx_splice() when callin

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix null dereference in hdmi teardown

In the Linux kernel, the following vulnerability has been resolved: afs: Fix potential null pointer dereference in afs_

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: check p->vec_buf for NULL When t

In the Linux kernel, the following vulnerability has been resolved: kmsan: fix out-of-bounds access to shadow memory R

In the Linux kernel, the following vulnerability has been resolved: netfs: fix reference leak Commit 20d72b00ca81 ("ne

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted

In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Implement refcount to handle

An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 210

An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 210

NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin accoun

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 128

Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Pri

A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoin

Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Att

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide cus

An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A s

SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The

Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during

Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled du

Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS fla

Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker

A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoi

A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to by

A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Den

Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limitin

Cross-site Scripting (XSS) stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute Java

Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affe

A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to r

Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of

Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect ser

Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may af

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services

ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged

In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix buffer overflow in USB transport layer

Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthent

A weakness has been identified in bftpd up to 6.2. Impacted is the function expand_groups of the file options.c of the c

A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown process

A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the compo

A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/control

A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality