2025

Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is

There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received

‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, thi

The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, a

Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an attac

Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action i

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmi

Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitte

Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Da

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.

An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string input

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated atta

The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The

Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH

Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The en

The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but lacks proper server-si

NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of func

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data cre

NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Ser

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write. A

NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware contro

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote auth

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, lea

The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all

The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Telegram username i

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth

Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based tim

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to versio

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.1

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.1

Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, p

Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confi

Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition poten

Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, a

A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced

Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, p

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downl

An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allo

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST

ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName.

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially craft

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set

A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer