2025

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a

Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and r

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account addre

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_pric

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f

A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.

A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.

DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileg

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0

Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below co

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below co

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to in

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directo

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (link

The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of th

A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Mana

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Se

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple version

In high traffic environments, a Silicon Labs OpenThread RCP (see impacted versions) fails to clear the SPI transmit buff

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During th

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0,

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Upda

An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause pa

A client-side remote code execution vulnerability exists in Hanwha Techwin Smart Security Manager (SSM) versions 1.32 an

Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior t

A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to

A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to pro

A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the insta

An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php e

A stack-based buffer overflow vulnerability exists in i-Ftp version 2.20 due to improper handling of the Time attribute

An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML lo

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central serv

ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remo

Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and

A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user

The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocat

Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authenticati

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default c

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. T

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper res

A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Li

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging e

A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthent

A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered.

A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered.