2025

In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission c

In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code e

In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This c

In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across us

In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitiali

In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overl

In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error i

In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to loca

In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use afte

In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after fr

In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of ser

In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This coul

A vulnerability was determined in Campcodes Online Water Billing System 1.0. This affects an unknown function of the fil

An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker

Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part o

Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload f

Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensiti

Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap c

IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT

NVIDIA NeMo Framework for all platforms contains a vulnerability in the export and deploy component, where malicious dat

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by a

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by a

NVIDIA NeMo Framework for all platforms contains a vulnerability in the retrieval services component, where malicious da

NVIDIA NeMo Curator for all platforms contains a vulnerability where a malicious file created by an attacker could allow

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side reques

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick vers

IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK,

Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote at

A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated at

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic

The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied

A non-primary administrator user with admin rights to the web interface but without shell access permissions can display

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to conduct phishing attacks, using an open

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due t

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim.

traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists wh

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage me

A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to exec

The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. T

SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fie

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sani

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly hand

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.p

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.p

A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the se

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were disco

Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android