2025

An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFil

A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing ser

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /h

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification se

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pb

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability i

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the inp

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attem

Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.

Out-of-bounds Write vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with p

Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with pr

Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with p

Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh:

Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that exec

rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to version 1.

pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and n

An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. Th

A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx en

A path traversal vulnerability exists in multiple models of Selea Targa IP OCR-ANPR cameras, including iZero, Targa 512,

A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including i

An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web inter

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0

RISC Zero is a general computing platform based on zk-STARKs and the RISC-V microarchitecture. Due to a missing constrai

PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criter

The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-envir

The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a

PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_s

Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authenti

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a

A Heap-based Buffer Overflow vulnerability exists within the parsing of PRJ files. The issues result from the lack of pr

An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper va

Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking. This v

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.2

Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code

A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown funct

A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modul

A Reflected Cross Site Scripting (XSS) vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allo

Reflected Cross-Site Scripting (XSS) vulnerability in /pages/search-results-page in Nosto, which allows remote attackers

A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScrip

Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal u

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory ut

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feed