2025

filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTO

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality.

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloa

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Managemen

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo came

PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a R

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improp

Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.

Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.

Server-Side Request Forgery (SSRF) vulnerability in Ctera Portal 8.1.x (8.1.1417.24) allows remote attackers to induce t

An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privile

Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications pass

To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumerat

NVIDIA Resiliency Extension for Linux contains a vulnerability in the checkpointing core, where an attacker may cause a

NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a

NVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an attacker could cause predict

NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control

NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to cod

Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded exter

D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attacke

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27

FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site

A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to a

Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an una

Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the pa

Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the pa

A remote code execution issue exists in HPE OneView.

A stored cross-site scripting (XSS) vulnerability in the page_save component of Linksys E5600 V1.1.0.26 allows attackers

WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malic

WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary

WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to c

PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in

Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject ma

Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to in

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts

phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type com

In the Linux kernel, the following vulnerability has been resolved: parisc: Avoid crash due to unaligned access in unwi

In the Linux kernel, the following vulnerability has been resolved: page_pool: always add GFP_NOWARN for ATOMIC allocat

In the Linux kernel, the following vulnerability has been resolved: lan966x: Fix sleeping in atomic context The follow

In the Linux kernel, the following vulnerability has been resolved: netconsole: Acquire su_mutex before navigating conf

In the Linux kernel, the following vulnerability has been resolved: clk: thead: th1520-ap: set all AXI clocks to CLK_IS

In the Linux kernel, the following vulnerability has been resolved: io_uring/zctx: check chained notif contexts Send z

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix invalid probe error return val

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to detect potential corrupted nid in free

In the Linux kernel, the following vulnerability has been resolved: drm/msm: make sure last_fence is always updated Up

In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Add RDSEED fix for Zen5 There's an is

In the Linux kernel, the following vulnerability has been resolved: usbnet: Prevents free active kevent The root cause