2025

Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in g

A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploi

An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, i

An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file man

An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vici

A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper

An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of upl

A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered w

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial inter

An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible ove

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with variou

The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection v

Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Co

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authen

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a

An incorrect privilege assignment vulnerability in Palo Alto Networks Autonomous Digital Experience Manager allows a loc

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the

A security bypass vulnerability allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers ca

An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR AD

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-

A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization.

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-

Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Se

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the origin

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled

A vulnerability was identified in SUR-FBD CMMS where hard-coded credentials were found within a compiled DLL file. These

Remote attackers can execute arbitrary code in the context of the vulnerable service process.

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to versi

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to versi

Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows una

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version

An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope

A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Sh

A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code

wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages t

A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attac

Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a s

Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a s

System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This lead

Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Sec

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design i

ethereum is a common ethereum structs for Rust. Prior to ethereum crate v0.18.0, signature malleability (according to EI

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versio

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versio

HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In ve

An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote atta