23691 matches found
CVE-2025-54630
:Vulnerability of insufficient data length verification in the DFA module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2025-54631
Vulnerability of insufficient data length verification in the partition module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2025-45766
poco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is...
CVE-2025-54368 uv is vulnerable to ZIP payload obfuscation through parsing differentials
uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with...
CVE-2025-47807
In GStreamer through 1.26.1, the subparse plugin's subripunescapeformatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash...
CVE-2024-42048
OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the installation path. In combination with the application's behavior of loading DLLs from this location, this allows for DLL hijacking and may...
CVE-2025-47907
Cancelling a query e.g. by cancelling the context passed to one of the query methods during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with...
CVE-2025-43867
creationtimestamp| type| source ---|---|--- 2025-08-07 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-02...
CVE-2024-26189
creationtimestamp| type| source ---|---|--- 2025-08-07 02:21:03+00:00| seen| https://bsky.app/profile/nihonmatsu.bsky.social/post/3lvrohwexas2s 2025-08-07 02:21:03+00:00| seen| https://bsky.app/profile/nihonmatsu.bsky.social/post/3lvrohu2y2s2s 2025-08-07 02:21:04+00:00| seen|...
CVE-2025-8576
Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...
CVE-2025-8579
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
CVE-2025-8583
Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
CVE-2025-54783
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to inclu...
CVE-2025-54799
A flaw was found in github.com/go-acme/lego. The LEGO ACME client and library fail to enforce HTTPS communication when interacting with Certificate Authorities, allowing unencrypted data transmission. This vulnerability allows a malicious Certificate Authority or intermediary to intercept and...
CVE-2025-54387
IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path...
CVE-2024-42048
OpenOrange Business Framework version 1.15.5 is vulnerable to DLL hijacking due to overly permissive access controls on its installation directory. The flaw allows all authenticated users to write to the installation path, where the application subsequently loads DLLs. This condition can lead to ...
CVE-2025-50675
GPMAW 14.2 , a bioinformatics software by Lighthouse Data , contains a critical vulnerability (CWE-276 ) due to insecure file permissions in its installation directory (C:\Program Files\gpmaw). The directory grants full control to the 'Everyone' group , allowing unprivileged users to modify or re...
CVE-2025-55138
LinkJoin through 882f196 mishandles token ownership in password reset...