2025

DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on al

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital

z2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when writing from

An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS 

The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the 

Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 1

This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for

This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker

This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the respo

This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API end

This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API

This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided f

An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Ev

User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows

Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.

An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the

Stored XSS in Discussions in OpenText Content Management CE 20.2 to 25.1 on Windows and Linux allows authenticated malic

Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the

An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer co

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for inst

An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is d

Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attack

SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their

An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted req

Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.Thi

Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allo

Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite

A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database con

An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Lo

A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Informa

An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro

A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 thr

A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary

Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a lo

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices

The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screens

Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4

gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whet

In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute una

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive infor

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive infor

Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant t