2025

An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permissi

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when a

In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninit

In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check. Th

In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. Thi

In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input val

Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was d

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload fea

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storag

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulne

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacke

A path traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifyi

EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are

An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged locati

A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert

A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affect

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown func

Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior versi

The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memor

A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkConta

A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently e

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior

Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid s

The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter

The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in al

The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in

The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could

The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, a

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows enviro

The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees'

NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm

NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A suc

NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before th

NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files.

NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been free

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory cor

NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data is

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could le

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could le

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could le

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that appl

Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged pr

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ contai