Azure Billing Elevation of Privilege Vulnerability

Nuvation Energy Multi-Stack Controller Authentication Bypass

Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.

Upload Arbitrary Files

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.

Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt

Foreman: safemode bypass leading to rce

Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface

OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

OneUptime Synthetic Monitor RCE via exposed Playwright browser object

OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header

WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability

WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability

WordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerability

StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection

Coolify members can see private key of root user

Coolify has Git Repository RCE

WordPress Shopo <= 1.1.4 - Arbitrary File Upload Vulnerability

Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization

Langflow OSS is affected by multiple vulnerabilities

Kiteworks Core Authentication Bypass in the Password Reset Workflow

RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

RDMA/siw: Bound fragmented header copies by the remaining length

Langflow OSS is affected by multiple vulnerabilities

Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager

Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent

Authentication Bypass Vulnerabilities in ClearPass Policy Manager

Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager

Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager

Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access

Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution

Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S

Authentication Bypass Vulnerability in the Management Interface of AOS-S

Authentication Bypass in the Web Management Interface of AOS-S

In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.

WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability

Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer

File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.

WordPress DZS Video Gallery plugin <= 12.37 - PHP Object Injection Vulnerability

WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability

WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.Boomplayer: 7.4.63.

An unauthenticated user is able to introduce SQL Injection using the Awie export module

Unauthenticated configuration import allows administrative account creation using AWIE component

Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover

FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover

AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover

XSS in Tegsoft's Online Support Application

Authentication bypass in IBM API Connect

Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

SQLi in Akıllı Ticaret's E-Commerce Pack

SQLi in Akilli Commerce's E-Commerce Website

Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation

Backstage: Sensitive information exposure in Scaffolder

Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)

Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

OS command injection in Progress Software Autonomous REST Connector GenAI Agents

Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S

Microsoft SQL Server Elevation of Privilege Vulnerability

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Coolify vulnerable to command injection via docker-compose.yaml parameters

Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server

Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha

Undisclosed RCE in Zammad v6.3 and higher

Security Advisory 0193

Kiteworks Email Protection Gateway Improper Access Control

Colify has command injection vulnerability in project git source

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

Nuvation Energy nCloud Client-to-Client Communication

Nuvation Energy Multi-Stack Controller OS Command Injection

Coolify has Stored XSS in Project Name

Coolify has Docker Compose Injection issue

Authentication Bypass

Unsafe Deserialization Vulnerability in Manacle Technologies ERP System

SQL Injection Vulnerability in Manacle Technologies ERP System

Account Takeover Vulnerability in Manacle Technologies ERP System

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

Security Advisory 0190

Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

Security Advisory 0185

Security Advisory 0192

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S

VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.

NetMan 204 Missing Authentication for Administrative Functions

NetMan 204 Hard-coded Backdoor Credentials

Synway SMG Gateway Management Software OS Command Injection via radius_address

WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability

WordPress Automotive Listings plugin <= 18.6 - SQL Injection vulnerability

Nuvation Energy BMS Client-side Authentication

SQL injection in Zeon Academy Pro by Zeon Global Tech

WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability

WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability

WordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection Vulnerability

WordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerability

Plaintext Storage of a Password in Sparx Pro Cloud Server.

Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user

The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploited if the service is exposed in environments where the remoting ports are accessible.

wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement

WELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File Upload

Sunnet｜WMPro - Arbitrary File Upload

GOSTCTR implementation unable to process more than 255 blocks correctly

Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security Decision

Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway

apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker

MegaSys Computer Technologies Telenium Online Web Application Improper Input Validation

FileThingie 2.5.7 Arbitrary File Upload via ft2.php

Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution

Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.

llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

Handlebars: JavaScript Injection via Own Property Check Bypass

An HTTP header injection vulnerability was found in the ADM

jsPDF has Local File Inclusion/Path Traversal vulnerability

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Studio (All versions < V2506.0001), Simcenter System Architect (All versions < V2506.0001), Tecnomatix Plant Simulation (All versions < V2504.0007). The SALT SDK is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

Rockwell Automation FactoryTalk Historian Site Edition - Authentication Bypass

Gitea built-in SSH server authentication bypass through key case folding

Foreman: excessive permissions for viewer role on preview

Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface

Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S

The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.

Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.

LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.

Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Apache Airflow: Airflow Logout Not Invalidating JWT

Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass

DVP-12SE11T - Out-of-bound memory write Vulnerability

DVP-12SE11T - Password Protection Bypass

Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs

Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component

Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge

Security Advisory 0197

wolfSSH ECDSA host key curve not validated against negotiated algorithm

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

This vulnerability allows a Backup or Tape Operator to write files as root.

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.

TRENDnet TEW-713RE formFSrvX os command injection

D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow

Backstage: Improper validation of TechDocs MkDocs configuration

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Langflow OSS is affected by multiple vulnerabilities

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Kiteworks Core OS Command Injection

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

wifi: cfg80211: don't filter by BSS type when removing stale entries

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator

Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manager API

Command Injection Vulnerability in the ClearPass Policy Manager Client Software

Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Manager

Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management Interface

Improper Access Control in HPE Networking ClearPass Android Client Application

Authenticated Privilege Escalation Vulnerability in the API of AOS-S

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

WordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerability

lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()

An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.

Apache Kyuubi: Unauthorized directory access due to missing path normalization

NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Privilege escalation during the installation of Norton Secure VPN via the Microsoft Store

muffon has One-click Remote Code Execution via XSS and Custom URL Handling

Priority - CWE-434 Unrestricted Upload of File with Dangerous Type

A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.

WordPress DZS Video Gallery plugin <= 12.25 - PHP Object Injection vulnerability

Integer Overflow or Wraparound in GPS

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing a file may lead to memory corruption.

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability

WordPress WPCHURCH plugin <= 2.7.0 - Privilege Escalation Vulnerability

WordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection Vulnerability

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox.

WP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Upload

IDOR in Yordam Informatics' Library Automation System

RCE in Yordam Informatics' Library Automation System

Improper Access Control in Yordam Informatics' Library Automation System

BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion

Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.

IDOR in APPYAP's Yaay Social Media App

Arbitrary File Upload in EchoCCS's Specto CM

ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php

phpTransformer 2016.9 SQL Injection via GeneratePDF.php

PlayJoom 0.10.1 SQL Injection via catid Parameter

ServerZilla 1.0 SQL Injection via email Parameter

EdTv 2 SQL Injection via id Parameter

BitZoom 1.0 SQL Injection via rollno Parameter

StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags

GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript

Authenticated RCE via render-components Entry Type overrides

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.

Security Advisory 0195

Security Advisory 0190

Kiteworks Core stored XSS

Kiteworks Core stored XSS

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

OneUptime: WhatsApp Webhook Missing Signature Verification

QGIS had validated RCE and Repository Takeover via GitHub Actions

Hardcoded credentials in Comarch ERP Optima

Coolify has a privilege escalation - low privileged user can invite themselves as an admin user

Nuvation Energy Multi-Stack Controller OS Command Injection

Columbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended Endpoints

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo

Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.

SQL injection in Eventobot

Quanta Computer｜QOCA aim AI Medical Cloud Platform - Arbitrary File Upload

WELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File Read

Sunnet｜WMPro - Arbitrary File Read

Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities

Arista CloudVision Exchange (CVX) Cluster Privilege Escalation via MCS Redis Session

Mitsubishi Electric Europe smartRTU Missing Authentication for Critical Function

AMPPS 2.7 Denial of Service via Malformed Socket Connection

Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

Security Advisory 0190

Security Advisory 0189

Security Advisory 0189

BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service.

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability

Columbia Weather Systems MicroServer Command Shell in Externally Accessible Directory

Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.

A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.

Data Exposure in Kings Information & Network KESS Enterprise

Plugin Organizer < 10.2.4 - Subscriber+ SQLi

webERP 4.15.1 - Unauthenticated Backup File Access

SIPP 3.3 Stack-Based Buffer Overflow via Configuration File

PMS 0.42 Stack-Based Buffer Overflow via Configuration File

SC v7.16 Stack-Based Buffer Overflow Remote Code Execution

iSelect 1.4.0-2+b1 Local Buffer Overflow via key parameter

HNB Organizer 1.9.18-10 Local Buffer Overflow via -rc Parameter

PInfo 0.6.9-5.1 Local Buffer Overflow via -m Parameter

HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata

Backstage: Improper task state validation in Scaffolder backend

Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage: Improper input validation in Sentry scaffolder actions

patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

Langflow OSS is affected by multiple vulnerabilities

Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.

WordPress Ninja Tables plugin <= 5.2.4 - SQL Injection vulnerability

WordPress BWL Pro Voting Manager plugin <= 1.4.9 - SQL Injection vulnerability

WordPress Brands for WooCommerce plugin <= 3.8.6.3 - SQL Injection vulnerability

WordPress Lobo theme < 2.8.6 - SQL Injection vulnerability

Coolify has host header injection in forgot password

Authenticated RCE in KAON PG5298

Apache Ignite: REST HTTP arbitrary file read vulnerability

Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation

WordPress Premium SEO Pack <= 3.3.2 - SQL Injection Vulnerability

WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerability

WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability

Account Takeover in Gmission Web FAX

Unrestricted File Upload and RCE in Innorix WP

Eddie VPN 2.24.6 - Local Privilege Escalation

SonarQube 8.3.1 - Unquoted Service Path

AnyDesk 5.4.0 - Unquoted Service Path

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.

Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint

Microsoft Office Remote Code Execution Vulnerability

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Privilege Escalation in Gmission Web FAX

Cache Misconfiguration Leading to Cross-User Data Exposure

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).

During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged local user to perform arbitrary reads or writes to privileged memory regions.

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Langflow OSS is affected by multiple vulnerabilities

libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

Rockwell Automation FactoryTalk Analytics PavilionX

Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Foreman: command injection in foreman-rake database tasks

Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.

Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

Malicious Code Execution Vulnerability in the Software Keyboard Function of GENESIS64, ICONICS Suite, Mobile HMI, and MC Works64

Unauthorized Arbitrary File Read via RMI in AdminServer Interface

Backstage: Scaffolder action input authorization bypass

Backstage: Improper authentication in the OIDC provider

Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

Langflow OSS is affected by multiple vulnerabilities

Kiteworks Core Stored Cross-site Scripting (XSS)

Kiteworks Core deserialization of untrusted data

IB/isert: wait for deferred control PDU completions before releasing the connection

cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

net: lan743x: fix RX checksum use-after-free

Langflow OSS is affected by multiple vulnerabilities

Gitea installer authentication bypass for existing accounts

Langflow OSS is affected by multiple vulnerabilities

VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability

OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Tugtainer has RCE in Agent Command Execution Api

WordPress FreeAgent theme <= 2.1.2 - Local File Inclusion vulnerability

WordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerability

WordPress Frappé theme <= 1.8 - Local File Inclusion vulnerability

WordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerability

WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability

WordPress Lekker theme <= 1.8 - Local File Inclusion vulnerability

WordPress Docket Cache plugin <= 24.07.03 - Local File Inclusion vulnerability

WordPress Hendon theme < 1.7 - Local File Inclusion vulnerability

WordPress Curly theme < 3.3 - Local File Inclusion vulnerability

WordPress Optimize theme < 2.4 - Local File Inclusion vulnerability

WordPress Wellspring theme < 2.8 - Local File Inclusion vulnerability

WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability

Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to

WordPress VideoPro theme <= 2.3.8.1 - Local File Inclusion vulnerability

Apache Airflow: RCE by race condition in example_xcom dag

Apache NuttX RTOS: fs/vfs/fs_rename: use after free

Apache StreamPipes: Leverage of User ID for Privilege Escalation

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.

WordPress WPCHURCH plugin <= 2.7.0 - Local File Inclusion vulnerability

WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability

WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability

WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability

WordPress Atlas theme <= 2.1.0 - Local File Inclusion vulnerability

DVP-12SE11T - Authentication Bypass via Partial Password Disclosure

Poly Video - Sensitive Data Might Be Written to Log File

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).

Apache CloudStack: MinIO policy remains intact on bucket deletion

In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

An OS Command Injection vulnerability in Nokia MantaRay NM

An OS Command Injection vulnerability in Nokia MantaRay NM

Firebird: Information leak vulnerability in firebird3 client when used with newer server

Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access

Hydra instantiate target blacklist bypasses permit code execution

Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation

Kiteworks Core Local Privilege Escalation

Kiteworks Core Local Privilege Escalation

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

esp: downgrade zerocopy managed frags before mutating skb frags

RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

RDMA/rxe: validate access flags before swapping the MR's PD

xfrm: hold net_device reference under RCU in bundle creation

RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths

wifi: cfg80211: don't free driver-owned scan requests

dmaengine: pxa: fix double counting of the hw descriptors

netfilter: flowtable: hold reference on ct until flow is released

smb: client: validate absolute native symlink targets before NT fixups

ntfs: protect runlist updates with the runlist lock

wifi: virt_wifi: don't transfer operstate before register

net: dsa: mxl862xx: disable the stats poll on teardown

futex: Also allocate private hash on vfork()

net: lock the socket in sock_gettstamp()

exec: Cleanup POSIX timers right after de_thread()

posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

signal: Prevent exec() race

swiotlb: use the adjusted address for the highmem page lookup

RDMA/ucma: Serialize join and leave on copy_to_user failure

openvswitch: avoid reallocating confirmed conntrack labels

ipv6: xfrm: use full sockets in local error paths

xfrm: save input state data before secpath resets

mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

drm/ttm: fix swapped-out resources never leaving their bulk_move range

cgroup: Avoid iteration of dying tasks with zero refcount

Local Authenticated Buffer Overflow Vulnerability in the ClearPass Policy Manager OnGuard Agent

Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in the ClearPass Policy Manager Windows Client Software

Authenticated Local Privilege Escalation in ClearPass Policy Manager OnGuard Linux Agent

NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Missing Authorization in Core

Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.

Microsoft Access Remote Code Execution Vulnerability

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Projected File System Elevation of Privilege Vulnerability

Windows Client-Side Caching Elevation of Privilege Vulnerability

Windows Projected File System Elevation of Privilege Vulnerability

Windows Projected File System Elevation of Privilege Vulnerability

Windows Projected File System Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Windows Storage VSP Driver Elevation of Privilege Vulnerability

Windows Storage VSP Driver Elevation of Privilege Vulnerability

Windows Projected File System Elevation of Privilege Vulnerability

This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.

PowerShell Remote Code Execution Vulnerability

In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Untrusted Pointer Dereference in Power Optimization Firmware

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Untrusted Pointer Dereference in Camera

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Improper Validation of Array Index in Automotive Linux OS

Stack-based Buffer Overflow in Camera Driver

Buffer Over-read in Camera

Buffer Copy Without Checking Size of Input in Automotive Platform

Buffer Copy without Checking Size of Input in DSP Service

Untrusted Pointer Dereference in Camera

Double Free in Video

Use of Uninitialized Variable in HLOS

Out-of-bounds Write in HLOS

Untrusted Pointer Dereference in Video

Use After Free in HLOS

An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. An app may be able to gain root privileges.

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.

Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently protected credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to credential exposure. The attacker may be able to use the exposed credentials to access the system with privileges of the compromised account.

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

In mminfra, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267349; Issue ID: MSV-5033.

In c2ps, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10274607; Issue ID: MSV-5049.

In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5533.

In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5534.

In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10314745; Issue ID: MSV-5553.

In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10276761; Issue ID: MSV-5141.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4699.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184061; Issue ID: MSV-4712.

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4729.

IBM Concert Software Improper Restriction of Operations within the Bounds of a Memory Buffer.

Avira antivirus engine heap buffer OOB read when scanning a malformed Windows MSI file

Avast antivirus heap OOB when scanning a malformed zip file

Avast antivirus heap buffer OOB read when scanning a malformed PE file

Avast antivirus heap buffer OOB read when scanning a malformed PE file

Avast antivirus heap buffer OOB write when scanning a malformed PE file

Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 1)

Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 2)

Linux-pam: linux-pam directory traversal

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to escalate privileges via the DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages components.

Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Backstage: Improper validation of MkDocs theme configuration in TechDocs