2025

Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large request

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an insecure hashing algorithm vulnerability. The product

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_conte

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_cont

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in mul

IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of th

A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to cr

An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent rep

A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine.

A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list

In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator

A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset l

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` he

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment var

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to rese

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet For

** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to jo

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to jo

Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker t

Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dua

Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.

The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability che

Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the

ASDA-Soft Stack-based Buffer Overflow Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability

The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be

Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers 

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.2, Frigate'

OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSe

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phon

Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered

When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microk

When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the

When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalat

A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with el

A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment t

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resour

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the

A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administ

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escala

Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagr

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for th

When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cip

When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increas

When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authentica