CVE-2025-10020: Improper Neutralization of Special Elements used in a Command

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component...

CVE-2025-6542: Improper Neutralization of Special Elements used in an OS Command

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker...

CVE-2025-6239: Exposure of Sensitive Information to an Unauthorized Actor

Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor...

CVE-2025-61181: Unrestricted Upload of File with Dangerous Type

daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature...

CVE-2025-7473: XML Injection (aka Blind XPath Injection)

Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection...

CVE-2025-57838: Exposure of Sensitive Information to an Unauthorized Actor

Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-57839: Exposure of Sensitive Information to an Unauthorized Actor

Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-57837: Exposure of Sensitive Information to an Unauthorized Actor

Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-8049: Insufficient Granularity of Access Control

Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low-privilege user to elevate privileges within the application. This issue affects Flipper: 3.1.2...

CVE-2025-3465: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSense™ HM: through 2.3.1; CoreSense™ M10: through 1.4.1.12...

CVE-2025-9574: Missing Authentication for Critical Function

Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware versions with the Serial Number from 2000 to 5166...

CVE-2025-10678: Use of Default Credentials

NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not...

CVE-2025-47902: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5...

CVE-2025-47900: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5...

CVE-2025-5517: Heap-based Buffer Overflow

Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox UL40/80A, ABB Terra AC wallbox UL32A, ABB Terra AC wallbox MID/ CE -Terra AC MID, ABB Terra AC wallbox MID/ CE -Terra AC Juno CE, ABB Terra AC wallbox MID/ CE -Terra AC PTB, ABB Terra AC wallbox JP.This issue affects Terra AC wallbo...

Poppler Installed (macOS)

Binary data macospopplerinstalled.nbin...

CVE-2025-62650: Use of Client-Side Authentication

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen...

CVE-2025-11900: Improper Neutralization of Special Elements used in an OS Command

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-60514: Improper Neutralization of Special Elements used in an SQL Command

Tillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts...

CVE-2025-60359: Missing Release of Memory after Effective Lifetime

radare2 v5.9.8 and before contains a memory leak in the function rbinobjectnew...