ImageMagick DestroyImage Buffer Overflow DoS

The vulnerability of the DestroyImage function in the MagickCore/image.c component of the ImageMagick console graphic editor is related to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

ROS-20260209-73-0012

A vulnerability in the HTTP Client API component of the OpenSSL cryptographic library is related to reading beyond memory boundaries. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

HGiga C&Cm@il 访问控制错误漏洞

HGiga C&Cm@il is an email collaboration system developed by China’s HGiga Corporation. There is an access control vulnerability in HGiga C&Cm@il, which stems from the lack of authentication. This vulnerability could allow unverified remote attackers to read and modify the email content of any use...

GnuTLS 安全漏洞

GnuTLS is an open-source, free security communication library developed by GnuTLS that enables the implementation of SSL, TLS, and DTLS protocols. There is a security vulnerability in gnutls. This vulnerability stems from the possibility of remote, unverified attackers sending specially crafted...

CVE-2025-68621

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC...

FUXA 安全漏洞

FUXA is a web-based process visualization software developed by frangoteam. Versions of FUXA 1.2.9 and earlier contain security vulnerabilities. These vulnerabilities stem from authorization bypasses, which could allow unverified remote attackers to modify device labels...

Linux safexcel_probe_generic() Data Compromise

The vulnerability of the safexcelprobegeneric function in the Linux operating system is related to state management errors. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information...

Linux stripe_io_hints() Data Compromise

The vulnerability of the stripeiohints function in the Linux operating system is related to integer overflow or cyclic shift attacks. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

@adonisjs/lucid 安全漏洞

@adonisjs/lucid is a database object-relational mapping library open-sourced by the AdonisJS Framework. Versions of @adonisjs/lucid before 10.1.3 and versions before 11.0.0-next.9 have security vulnerabilities. These vulnerabilities stem from prototype pollution in the parsing of multi-part form...

Nodogsplash - Directory Traversal

Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system. id: CVE-2023-39120 info...

EUVD-2026-5390

Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability...

lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure

A flaw was found in lz4-java. This vulnerability allows remote attackers to cause denial of service DoS and read adjacent memory via untrusted compressed input. This vulnerability affects only programs using the unsafe LZ4decompressfast API, known as the "fast" decompressor...

SAMSUNG Members 安全漏洞

Samsung Members is a community platform app developed by South Korea’s Samsung Corporation. Versions of Samsung Members prior to 5.6.00.11 contained security vulnerabilities. These vulnerabilities stemmed from improper input validation, potentially allowing remote attackers to connect to arbitrar...

CVE-2020-37082

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backuptimestamp.sql.gz file...

CVE-2020-37076

Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted UNION SELECT payloads to extract database information through boolean-based,...

CVE-2025-67188

A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204B20210112. The issue resides in the setRadvdCfg interface of the /lib/cstemodules/ipv6.so module. The function fails to properly validate the length of the user-controlled radvdinterfacename parameter, allowing remote attacker...

CVE-2020-37108

PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of productdetail.php that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the 'id' parameter to potentially extract or modify database information...

CVE-2020-37108

PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of productdetail.php that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the 'id' parameter to potentially extract or modify database information...

CVE-2020-37108

The CVE-2020-37108 issue affects PhpIX 2012 Professional and is caused by an SQL injection in the id parameter of product_detail.php, enabling remote manipulation of database queries. Affected component: product_detail.php (id parameter). Underlying cause: improper handling/sanitization of user i...

CVE-2025-67481

A flaw was found in MediaWiki. This vulnerability, known as Cross-site Scripting XSS, allows a remote attacker to inject malicious scripts into web pages. By failing to properly neutralize input during web page generation, MediaWiki can be exploited to execute arbitrary code in the context of a...