2025

SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting

Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could al

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identit

DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appli

The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the acc

A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allo

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensi

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to exe

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to exe

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticate

A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of

VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive info

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St

An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (R

The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in th

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se

A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that allows a local networ

Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint

There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure.

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line pa

A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /gof

A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper me

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.00

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti

Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i

Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via th

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology Bee

Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attack

Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-139

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memo

In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd

In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_no

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active b

In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if alread

In the Linux kernel, the following vulnerability has been resolved: nios2: ensure that memblock.current_limit is set wh

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in __hfsplus_

In the Linux kernel, the following vulnerability has been resolved: hfs: fix KMSAN uninit-value issue in hfs_find_set_z

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_p

In the Linux kernel, the following vulnerability has been resolved: erofs: fix crafted invalid cases for encoded extent

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer

In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmentin

An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/uplo