2025

PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK). Version 0.46.3

KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Fo

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0

Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote C

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in ver

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to ver

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2.

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and wid

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is

When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it

When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the du

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte p

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the S

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field suppli

The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creatio

When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading t

SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retri

In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged

Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17

Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and n

MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attac

A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalat

Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) all

Incorrect authentication vulnerability in OpenSIAC, which could allow an attacker to impersonate a person using Cl@ve as

Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/soc

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensiti

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture.

In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the paramet

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle

Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper va

Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper va

DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robo

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.1

An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log dat

serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions th

The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have

MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 comp

vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding a

An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS pl

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is n

A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of

In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/ha

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attemp

Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versio