2025

Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve,

This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service.

Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant

When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-

The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provi

Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service

Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any ap

No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. T

A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with r

A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authenticatio

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentic

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users

Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox conf

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security L

A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF

Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Es

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated cr

Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with a

MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were deli

General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 202207

The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the

An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credenti

SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys und

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve,

The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since t

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion

Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8

Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of s

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11

Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insuf

Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response string

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (adm

A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability

This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) pa

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unp

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its

The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: befo

An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances vi

color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayis