CVE-2025-26613

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, gerenciarbackup.php endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. This issue ha...

CVE-2025-1354

A cross-site scripting XSS vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of...

CVE-2025-1336

A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimgaction in the library lib/admin/imageadmin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The explo...

CVE-2025-1302

CVE-2025-1302 affects jsonpath-plus

CVE-2024-35373

Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php...

PT-2025-6710 · Apache · Apache Ignite

Name of the Vulnerable Software and Affected Versions: Apache Ignite versions 2.6.0 through 2.17.0 Description: The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it t...

CVE-2025-25993

The CVE-2025-25993 entry concerns FeMiner WMS 1.0 with a SQL injection in the itemid parameter that can leak sensitive information. Affected software: FeMiner WMS (v1.0). Root cause: improper handling of the itemid input allowing injection. Impact per sources: confidentiality information disclosu...

Microsoft High Performance Compute (HPC) Pack (CVE-2025-21198)

A remote code execution vulnerability exists in Microsoft High Performance Compute HPC Pack prior to 2019 update 3. An authenticated, adjacent attacker can exploit this to execute arbitrary commands on the target system. Note that Nessus has not tested for this issue but has instead relied only o...

CVE-2025-1052

Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2025-1214 pihome-shc PiHome Role-Based Access Control user_accounts.php authorization

A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /useraccounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-26362

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests...

CVE-2025-25526

Buffer overflow vulnerability in Mercury MIPC552W Camera v1.0 due to the lack of length verification, which is related to the configuration of the PPTP server. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands...

CVE-2022-35202

A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain non-default scenarios, to gain access to the private keys used for signing SAML Authn requests. The underlying issue is a Java keystore that may become accessible and downloadable via WebDAV. This keystor...

CVE-2025-21371 Windows Telephony Service Remote Code Execution Vulnerability

...

CVE-2025-21201 Windows Telephony Server Remote Code Execution Vulnerability

...

CVE-2025-21208

CVE-2025-21208 is a Windows RRAS Remote Code Execution vulnerability. The NVD entry confirms the issue as a network‑vector RCE with high impact (CVSSv3.1: 8.8, C/H/I/A = high; AV:N, AC:L, PR:N, UI:R, S:U). The vulnerability is tied to Windows RRAS and has a documented CVE entry; exploitation/avai...

CVE-2025-24472

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to...

CVE-2024-12058

External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files...

PandasAI interactive prompt function Remote Code Execution (RCE)

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution RCE instead of the intended explanation of the natural language processing by the LLM. The security controls of PandasAI 2.4.3 and earlier fail ...

CVE-2024-11771

Ivanti CSA (Cloud Services Appliance) is affected by CVE-2024-11771: a path traversal vulnerability in versions before 5.0.5 allows a remote unauthenticated attacker to access restricted functionality. The CVSS v3.1 base score is 5.3 (Medium); attack vector NETWORK, no privileges required, no use...