2025

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.

Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over

Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locall

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to

Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacke

Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetiz

Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Control

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o

Cursor is a code editor built for programming with AI. In versions 0.45.0 through 0.48.6, the Cursor app introduced a re

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write

A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw

A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw

IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE)

An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows rem

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthentica

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticate

DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated atta

Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb ver

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in

A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versio

Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilitie

Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intend

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installa

The WPFront User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: fix shmem xarray update during migratio

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/

In the Linux kernel, the following vulnerability has been resolved: Revert "arm64: dts: qcom: sdm845: Affirm IDR0.CCTW

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected de