CVE-2024-47261

51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device...

CVE-2025-32414

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters...

Shopware 安全漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware, which stems from a store-api that detects the existence of an e-mail account, which could lead to information disclosure...

CVE-2025-32414

CVE-2025-32414 concerns libxml2 prior to 2.13.8 and 2.14.x prior to 2.14.2, where the Python bindings can trigger an out-of-bounds memory access due to an incorrect return value in the Python API. Affected code paths include xmlPythonFileRead and xmlPythonFileReadRaw, caused by a mismatch between...

CVE-2025-21421

Memory corruption while processing escape code in API...

The vulnerability of the webapi component in the operating systems Synology BeeStation Manager (BSM), Synology DiskStation Manager (DSM), and Synology BeeStation OS allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the webapi component in Synology BeeStation Manager BSM, Synology DiskStation Manager DSM, and Synology BeeStation OS is related to a lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability can allow an attacker operating remotely to gain...

PT-2025-15200 · Qualcomm · Snapdragon +35

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue involves memory corruption that occurs while processing an escape code in an API. Recommendations: At the moment, there is no information about a newer version that contains a fix...

CVE-2025-32359

In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not wh...

UBUNTU-CVE-2024-57868

Web::API 2.8 and earlier for Perl uses the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random...

CVE-2024-57868

CVE-2024-57868 affects Web::API 2.8 and earlier for Perl. The root cause is use of rand() as the default entropy source via Data::Random, which is not cryptographically secure, for cryptographic functions. This is stated in the CVE description and supported by references to Data::Random and rand(...

PT-2025-18674 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-POE version 6.2c.884 B20180522 Description: A command injection issue was found in the CloudSrvUserdataVersionCheck function via the url parameter, allowing attackers to execute arbitrary commands through a crafted request...

BIT-DOLIBARR-2023-38888

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject...

BIT-DOLIBARR-2022-43138

Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API...

CVE-2025-30155

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8...

CVE-2025-21934 rapidio: fix an API misues when rio_add_net() fails

In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rioaddnet fails rioaddnet calls deviceregister and fails when deviceregister fails. Thus, putdevice should be used rather than kfree. Add "mport-net = NULL;" to avoid a use after free issue...

PT-2025-14461

Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description The issue concerns the Zabbix API, specifically the "user.get" endpoint, which returns all users that share a common group with the calling user. This includes sensitive information such as...

CVE-2025-30368

Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization wa...

CVE-2025-30155 Tuleap does not enforce read permissions on parent trackers in the REST API

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8...

lunary information disclosure vulnerability (CNVD-2025-08308)

lunary is lunary open source a production toolkit for LLM . An information disclosure vulnerability exists in lunary that stems from a GET /projects API endpoint exposing all project public and private API keys to users with least privileges, which can be exploited by an attacker to obtain...

@directus/api (>=15.0.0, <=24.0.1), @linotype/directus-extension-linotype (>=1.2.2, <=1.3.5) +8 more potentially affected by CVE-2025-30225 via directus (>=9.26.0, <=11.4.1)

directus NPM version =9.26.0, =15.0.0, =1.2.2, =0.1.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2025-30225 Source advisory: OSV:GHSA-J8XJ-7JFF-46MX...