2025

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereferen

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove b

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor sno

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple use

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple user

Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN vir

A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and de

A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability a

A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API.

A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in t

A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a val

PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within th

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `exp

An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Loo

A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sour

A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject mal

A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows

In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ens

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit

calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary ass

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1

Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2,

Various Ruijie Gateway EG and NBR models firmware versions 11.1(6)B9P1 < 11.9(4)B12P1 contain a code execution vulnerabi

Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async,

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direc

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova Smallworld on

Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue

A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains a

SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete datab

archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to fe

CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, C

Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to dow

A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-n

The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named

Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resu

When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-

The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.

Denial of service of the web server through specific requests to this protocol

The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is i

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of

An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially craft

Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obta