2025

Versions of Gliffy Online prior to versions 4.14.0-7 contains a Cross Site Request Forgery (CSRF) flaw.

A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with W

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could

Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of boun

Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.22

The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.Acces

smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner

Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.

Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of t

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticate

An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the ap

A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by impr

The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with defaul

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization design

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file loc

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances vi

This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpo

This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoin

This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in cer

An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-ad

A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthori

A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administra

An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unau

The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when th

Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-b

The ZOO-Project is an open source processing platform. The ZOO-Project Web Processing Service (WPS) Server contains a Cr

The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-

Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prio

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if ce

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior,

This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmwar

An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-20

An error related to the 2-factor authorization (2FA) on the RISC Platform prior to the saas-2021-12-29 release can poten

A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS,

mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmw

Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2,

A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does n

Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Param

DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Co

A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass

CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync`

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been fo

org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backend

zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are