2025

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthen

A vulnerability was found in oatpp Oat++ up to 1.3.1. It has been declared as critical. This vulnerability affects the f

A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified as critical. This affects the function ht

Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption a

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not hav

The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking

If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a

When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was inval

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing

When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correc

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. Th

The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affec

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified

A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140

A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol a

A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface

A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from

A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with lo

A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to

A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in

An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is

An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.

An low privileged remote attacker in possession of the second factor for another user can login as that user without kno

The Conference Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow

An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authent

A denial-of-service issue in the dns implemenation could cause an infinite loop.

WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Inje

WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Inje

WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. If exploited, an arbitrary script may be

WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command

Unrestricted upload of file with dangerous type issue exists in WRC-2533GST2, WRC-1167GST2, WRC-2533GST2, WRC-2533GS2V-B

Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. I

NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issue

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-sit

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .

Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenti

Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote

A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the functio

SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scr

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public

Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to