2025

The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectiv

Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary fil

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Inje

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Inje

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware

Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale a

SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter tak

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient

LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes

Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When

While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in log

Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parame