2025

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, m

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.3 and iPadO

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3,

Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families:

Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Al

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard

A directory traversal vulnerability was discovered in Pagure server. If a malicious user submits a specially cratfted gi

A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links

Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.

Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function.

An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c a

SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and ch

An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequ

An authenticated user attempting to change their password could do so without using the current password.

An authenticated user without user-management permissions could identify other user accounts.

An administrator could discover another account's credentials.

An authenticated user without user-management permissions could view other users account information.

An authenticated administrator could modify the Created By username for a user account

An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.

Users who were required to change their password could still access system information before changing their password

A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.

An authenticated user without user administrative permissions could change the administrator Account Name.

An unauthenticated user could discover account credentials via a brute-force attack without rate limiting

Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST par

IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardw

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Caissie BNS

An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arb

SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data g

EngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface.

An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism.

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very l

Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted sc

ARTEC EMA Mail 6.92 allows CSRF.

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to

Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code

Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by add

Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by pla

A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_

Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScr

Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScr

The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

julmud/phpDVDProfiler is an adoption of the defunct phpDVDProfiler project, which allows users to display on the web the

EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Know

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a