90950 matches found
CVE-2025-54545: Incorrect Permission Assignment for Critical Resource
On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges...
CVE-2025-64283: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RTMKit: from n/a through = 1.6.7...
CVE-2025-58188: Undefined Security Weakness
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains...
CVE-2025-58185: Undefined Security Weakness
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion...
CVE-2025-47912: Undefined Security Weakness
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...
CVE-2025-60595: Improper Neutralization of Special Elements used in a Command
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution...
CVE-2025-64288: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through = 1.3.19...
CVE-2025-12476: Missing Authentication for Critical Function
Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-12477: Missing Authentication for Critical Function
Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-61723: Undefined Security Weakness
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs...
CVE-2025-61724: Undefined Security Weakness
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption...
CVE-2025-58186: Undefined Security Weakness
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption...
CVE-2025-61725: Undefined Security Weakness
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...
CVE-2025-58187: Undefined Security Weakness
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains...
CVE-2025-64134: Improper Restriction of XML External Entity Reference
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2025-64135: Initialization of a Resource with an Insecure Default
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime...
appsec-sentinel
AppSec-Sentinel AI-powered security scanner with cross-file...
CVE-2025-54605: Uncontrolled Resource Consumption
Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption issue 2 of 2...
CVE-2025-36081: Improper Output Neutralization for Logs
IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input...