2025

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an ex

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificat

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificat

A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue a

NeKernal is a free and open-source operating system stack. Version 0.0.2 has a 1-byte heap overflow in `rt_copy_memory`,

A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkRe

The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and

The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoin

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to versio

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with vie

Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Se

An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any applicati

An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any applicati

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preload

Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where mu

Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In ver

Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints al

An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /co

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials

In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the in

Reflected Cross-Site Scripting (XSS) vulnerability in Real Easy Store. This vulnerability allows an attacker to execute

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote a

A Missing Authorization vulnerability has been found in DinoRANK. This vulnerability allows an attacker to access invoi

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a w

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the drive

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserByI

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentica

On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it

Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted acc

Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnera

Stored Cross-Site Scripting (XSS) vulnerability in i2A-Cronos version 23.02.01.17, from i2A. It allows an authenticated

User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a differen

Stored Cross-Site Scripting (XSS) vulnerability in the CoverManager booking software. This allows an attacker to inject

Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retriev

The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel gues

A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerabi

SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create

A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5

A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0

A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0

An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, an

On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly val

Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a loca

The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a

The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploi

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The