2025

A security flaw has been discovered in MikeCen WeChat-Face-Recognition up to 6e3f72bf8547d80b59e330f1137e4aa505f492c1. T

A vulnerability was identified in H3C Magic B3 up to 100R002. This affects the function AddMacList/EditMacList of the fi

A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functi

A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file

Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical

Improper input validation in Retail Mode prior to version 5.59.4 allows self attackers to execute privileged commands on

Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was pub

Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/probl

Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper acc

parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateContr

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setDa

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedR

A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject prop

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLi

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability i

toggle-array is a package designed to enables a property on the object at the specified index, while disabling the prope

spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config funct

A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers

rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes a

mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vul

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation

The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable

The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initializatio

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf

The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in

Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could pote

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, the file upload flow

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink

Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated use

A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user

The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Du

A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespa

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototy

Aztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the

Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affect

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X60

Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded res

Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerabi

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Softwa

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative pri

A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to

A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unau

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an una