1038 matches found
CVE-2024-8017 Cross-site Scripting (XSS) in open-webui/open-webui
An XSS vulnerability exists in open-webui/open-webui versions = 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their ow...
AZL-58861 CVE-2025-29786 affecting package keda for versions less than 2.14.1-5
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...
AZL-58848 CVE-2025-29786 affecting package coredns for versions less than 1.11.1-18
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...
AZL-58828 CVE-2025-2295 affecting package hvloader for versions less than 1.0.1-16
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service...
AZL-58635 CVE-2024-55549 affecting package libxslt for versions less than 1.1.34-8
xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes...
AZL-58422 CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...
Drupal AI (Artificial Intelligence) module < 1.0.5 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability discovered by Drew Webber mcdruid in WordPress Module AI Artificial Intelligence versions 1.0.5...
CVE-2025-27426
Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL This vulnerability affects Firefox for iOS 136...
AZL-57485 CVE-2025-22869 affecting package terraform for versions less than 1.3.2-24
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
Drupal Cache Utility module < 1.2.1 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Cache Utility versions 1.2.1...
Drupal OAuth2 Server module < 2.1.0 - Unauthenticated Broken Access Control vulnerability
Unauthenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module OAuth2 Server versions 2.1.0...
AZL-57479 CVE-2025-26597 affecting package xorg-x11-server for versions less than 1.20.10-15
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...
AZL-57378 CVE-2025-26595 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size...
Google Chrome < 133.0.6943.141 Vulnerability
The version of Google Chrome installed on the remote Windows host is prior to 133.0.6943.141. It is, therefore, affected by a vulnerability as referenced in the 202502stable-channel-update-for-desktop25 advisory. Note that Nessus has not tested for this issue but has instead relied only on the...
WordPress Carousel, Slider, Gallery by WP Carousel plugin < 2.7.4 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Carousel, Slider, Gallery by WP Carousel versions 2.7.4...
firefox: thunderbird: Certificate length was not properly checked
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed...
Drupal Configuration Split module < 1.10.0,2.0.0-2.0.1 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Eric Smith ericgsmith in WordPress Module Configuration Split versions 1.10.0,2.0.0-2.0.1...
CVE-2025-24812
A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly 6ES7211-1BE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1211C DC/DC/DC 6ES7211-1AE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1211C DC/DC/Rly 6ES7211-1HE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1212C AC/DC/Rly...
AZL-56758 CVE-2024-12133 affecting package libtasn1 for versions less than 4.19.0-2
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate,...
