2025

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Ma

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited duri

ethereum is a common ethereum structs for Rust. Prior to ethereum crate v0.18.0, signature malleability (according to EI

kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std

A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker t

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute

In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has a

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versio

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versio

HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreS

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versio

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: x1e80100: Add GPU cooling Unlike

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use list_first_entry_or_null for opinfo_get_

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check stream id dml21 wrapper to g

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In ve

WINSTAR WN572HP3 v230525 was discovered to contain a heap overflow via the CONTENT_LENGTH variable at /cgi-bin/upload.cg

An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote atta

A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automat

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload a

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remot

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Se

An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticate

A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the fo

The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers

Missing Authorization vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce.This issue

The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in th

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th

The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is g

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users

Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated u

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low pri

Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, wh

The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release vers

Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, whi

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after perfo

The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with roo

Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radi

Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Rad