2025

An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges

Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamp

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID pa

UnForm Server Manager versions prior to 10.1.12 expose an unauthenticated file read vulnerability via its log file analy

Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its d

RabidHamster R4 v1.25 contains a stack-based buffer overflow vulnerability due to unsafe use of sprintf() when logging m

Lattice Semiconductor ispVM System v18.0.2 contains a buffer overflow vulnerability in its handling of .xcf project file

PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functional

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By s

Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts.

Real Networks Netzip Classic version 7.5.1.86 is vulnerable to a stack-based buffer overflow when parsing a specially cr

Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY

GTA San Andreas Multiplayer (SA-MP) server version 0.3.1.1 is vulnerable to a stack-based buffer overflow triggered by p

Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed

NetOp (now part of Impero Software) Remote Control Client v9.5 is vulnerable to a stack-based buffer overflow when proce

WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the t

QuickShare File Server 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of us

S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sa

A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escala

Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code

A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share iden

An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect t

A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure

A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleart

An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to e

This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plai

This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. A

This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the

This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device f

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in

ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This v

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly chec

pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the paramete

Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Re

OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulner

YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An un

The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when

Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to insta

ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog para

Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upl

PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely

Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup lo

YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag config

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS (e.g.

Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research—from ideation to im