Netgear NETGEAR R6260 has a buffer error vulnerability

NETGEAR R6260 is a router from Netgear, Inc. NETGEAR R6260 routers is vulnerable because the setupwizard.cgi page fails to properly validate the length of data when parsing the SOAP LOGIN TOKEN environment variable. An attacker could exploit this vulnerability to execute arbitrary code on an...

STB security vulnerabilities

stb is a single-file public domain library for C/C. stbimage.h is one of the image loaders. stb stbimage.h is vulnerable, and an attacker could use stbimage to crash the service or read up to 1024 bytes of non-contiguous heap data without controlling where it is read...

Oracle Virtualization and Oracle VM VirtualBox security vulnerabilities

Oracle VM VirtualBox is a virtual machine management software from Oracle. An unspecified vulnerability in the Core component of Oracle VM VirtualBox versions prior to 6.1.28 can be exploited by an attacker to compromise Oracle VM VirtualBox by logging on to the Oracle VM VirtualBox execution...

WordPress plugin: access control error vulnerability

WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin PostX, which stems from Gutenberg Blocks in the Post Grid WordPress plugin prior to PostX - version 2.4.10 allows any logged in user to perform error checking before...

flask-restx Resource management error vulnerability

flask-restx is a software application. Fork Flask-RESTPlus: Full-featured framework for fast, simple and documented API development Bottle A resource management error vulnerability previously existed in Flask-RESTX version 0.5.1 that allowed an attacker to conduct a ReDoS Regular Expression Denia...

Git processing logic error vulnerability

Git is a free, open source distributed version control system. Git suffers from a Processing Logic Error vulnerability that stems from the fact that gitconnectgit in connect.c in Git prior to version 2.30.1 allows repository paths to contain line breaks, which can lead to unexpected cross-protoco...

ZOHO ManageEngine Log360 has a vulnerability related to cross-site request forgeing.

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity and comply with regulatory requirements.A code injection...

Exiv2 buffer error vulnerability

Exiv2 is a cross-platform C library and command-line utility for managing image metadata. a buffer overflow vulnerability exists in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmnint.cpp in Exiv2 version 0.27.99.0. An attacker could exploit this vulnerability to obtain information...

Google TensorFlow numerical error vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in Google TensorFlow. A local attacker could exploit this vulnerability to cause a denial of service condition...

Netgear NETGEAR security vulnerabilities

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. NETGEAR has a security vulnerability that stems from some NETGEAR devices being affected by privilege escalation...

WordPress and WordPress plugins have SQL injection vulnerabilities

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Secure Copy Content Protection plugin is an application plugin for WordPress. A SQL injection vulnerability exists in...

Cisco Firepower Device Manager code injection vulnerability

Cisco Firepower Device Manager FDM is a firewall device manager from Cisco USA. The product supports access rule configuration, system monitoring, and other functions. A code injection vulnerability exists in Cisco Firepower Device Manager, which can be exploited by an authenticated, remote...

vSwitch Open resource management error vulnerability

Open vSwitch is an open source virtual switch. A resource management error vulnerability exists in Open vSwitch a.k.a. openvswitch versions 2.11.0 through 2.15.0, which stems from the fact that in decodeNXASTRAWENCAP invoked from ofpactdecode and ofpactsdecode there is during decoding the RAWENCA...

Microsoft Bing security vulnerabilities

Microsoft Bing is a web search engine from Microsoft Corporation USA. A security vulnerability exists in Microsoft Bing. The following products and versions are affected: Microsoft Bing Search for Android...

Joomla! Code Issues and Vulnerabilities

Joomla! is a set of forum components used in the Joomla! content management system. A code issue vulnerability exists in Joomla! 2.5.0 - 3.9.27. The vulnerability stems from a hard-coded ACL check for superuser missing from the install operation in cominstaller, which can be exploited to execute...

Ubuntu Apport backend link vulnerability

Apport is a toolkit for collecting and feeding back error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from Apport incorrectly handling certain information-gathering operations, which can be...

Schneider Electric buffer error vulnerability

A buffer error vulnerability exists in Schneider Electric that stems from an improper restriction of operations within a memory buffer range. An attacker interacting with drivers installed by Vijeo Designer or EcoStruxure Machine Expert could cause a denial of service or unauthorized access to...

Pixar Ruby-JSS security vulnerability

ruby-jss is a Ruby framework for interacting with the JAMF Software Server JSS REST API. A security vulnerability in Pixar ruby-jss versions prior to 1.6.0, which stems from Marshal's documented behavior and is loaded during XML document processing, can be exploited by a remote attacker to execut...

OpenAPI Tools, OpenAPI Generator – Security Vulnerabilities

OpenAPI Tools OpenAPI Generator is an OpenAPI generator. The product allows automatic generation of API client libraries SDK generation, server stubs, documentation, configuration, etc. for a given OpenAPI specification v2, v3. A security vulnerability exists in Openapi generator. The vulnerabili...

Several Huawei products have been found to have vulnerabilities.

Huawei P30 is a smartphone from Huawei China.The Huawei P30 is vulnerable to JavaScript injection, which can be exploited by attackers to launch JavaScript injection by sending malicious application requests...

Envoy code-related vulnerabilities

Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to a null pointer dereference vulnerability, which can be exploited by attackers to crash the program...

Microsoft Windows DNS Server Security Vulnerabilities

Microsoft Windows DNS is a domain name resolution service from Microsoft. The Domain Name System DNS is one of the industry-standard suite of protocols that encompasses TCP/IP, and together, DNS clients and DNS servers provide name resolution services for computers and users that map computer nam...

MCP Server Kubernetes security vulnerabilities

MCP Server Kubernetes is a Kubernetes management server developed by Suyog Sonwalkar. Versions of MCP Server Kubernetes prior to 3.6.0 contained security vulnerabilities. These vulnerabilities stemmed from access control being executed at the tool discovery layer but not at the execution layer,...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a cross-platform web browser developed by Google. It is primarily used for accessing web pages, running web applications, and providing various extended features. There is a resource management vulnerability in Google Chrome, which stems from improper handling of references after...

Apple macOS security vulnerabilities

Apple macOS is a proprietary operating system developed by the American company Apple for Mac computers. Versions of Apple macOS Tahoe 26.1 had a security vulnerability due to logging issues, which could allow applications access to sensitive user data...

MIT Kerberos numerical error vulnerability

MIT krb5 is a network authentication protocol developed by the Massachusetts Institute of Technology in the United States. It operates on a client/server architecture, and both the client and server can perform identity authentication i.e., double verification, which helps prevent eavesdropping a...

GitLab Enterprise Edition (EE) and GitLab Community Edition (CE) security vulnerabilities

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. Versions of GitLab CE/EE prior to 15.9, 18.10.8, 18.11.5, and 19.0.2...

Google Chrome security vulnerabilities

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.115 contained a security vulnerability. This vulnerability stemmed from insufficient policy execution in the DevTools component, which could allow remote attackers to bypass the same-origin polic...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.5.6 contained a security vulnerability. This vulnerability stemmed from a bypass of the approval policy in the Skill Workshop application process, allowing proxy tools to set appl...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by Google Inc. In versions prior to 149.0.7827.115, there was a resource management vulnerability that stemmed from the reuse of resources after they were released in Core. This vulnerability could allow remote attackers to execute arbitrary code through a...

WordPress plugin WP Mail Log has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

VMware Spring Web Services security vulnerabilities

VMware Spring Web Services is a SOAP Web services development framework provided by the American company VMware. There are security vulnerabilities in versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8 of VMware Spring Web Services. These vulnerabilities stem from the...

Cerebrate information leakage vulnerability

Cerebrate is an open-source platform developed by Cerebrate. It aims to act as an interconnected coordinator for trusted contact information providers and other security tools. Prior to version 1.37 of Cerebrate, there was a vulnerability involving information leakage, which stemmed from exposing...

VMware Spring Web Services encryption vulnerability

VMware Spring Web Services is a SOAP web service development framework provided by the American company VMware. There are vulnerabilities related to encryption in VMware Spring Web Services versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8. These vulnerabilities stem fr...

Google Chrome buffer error vulnerability

Google Chrome is a cross-platform web browser developed by Google. It primarily offers functions such as web browsing, extension support, and multi-tab management. Google Chrome has a privilege escalation vulnerability, which stems from the VideoCapture component failing to properly validate memo...

WordPress plugin Newsletters SQL injection vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

Ansible post-link vulnerability

Ansible is an easy-to-use IT automation system developed under the open source license. Ansible has a post-installation link vulnerability, which originates from the Posix authorizedkey module. The keyfile function uses os.chown instead of os.lchown, and does not use ONOFOLLOW to open files, whic...

Dulwich operating system command injection vulnerability

Dulwich is a Python-based Git repository management interface developed by Jelmer Vernooij. Versions of Dulwich from 0.24.0 to 1.2.5 had a vulnerability related to operating system command injection. This vulnerability stemmed from ProcessMergeDriver’s ability to replace file paths into the merge...

Fission Access Control Vulnerability

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.24.0 contained a access control vulnerability. This vulnerability stemmed from the lack of namespace validation using the access webhook in the Fission Function specification for...

VMware Spring AMQP security feature vulnerability

VMware Spring AMQP is a message queue integration framework developed by the American company VMware. There is a security vulnerability in VMware Spring AMQP, which stems from the use of a fixed reply queue ID in the RabbitTemplate.sendAndReceive method, making it predictable due to an internal...

Fission Access Control Vulnerability

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.23.0 contained a access control vulnerability. This vulnerability stemmed from the storagevc component failing to perform any authentication or authorization when registering the archive CR...

ImageMagick buffer error vulnerability

ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It can read, convert, and write images in various formats. Versions of ImageMagick prior to 6.9.13-47 and 7.1.2-22 contained a buffer error vulnerability. This vulnerability occurred when malicious...

Splunk Enterprise Cross-Site Script Vulnerability

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. Both Splunk Cloud Platform and Splunk...

Splunk Enterprise: Input Validation Error Vulnerability

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. There is an input validation...

Palo Alto Networks PAN-OS code-related vulnerabilities

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall devices. There is a code vulnerability in Palo Alto Networks PAN-OS, which stems from memory corruption during tunnel traffic processing. This vulnerability could allow authenticated users to initiat...

ImageMagick security vulnerabilities

ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It allows for reading, converting, and writing images in various formats. Versions of ImageMagick prior to 6.9.13-48 and 7.1.2-23 contained security vulnerabilities. These vulnerabilities stemmed...

Metrics::Any::Adapter::SignalFx Injection Vulnerability

Metrics::Any::Adapter::SignalFx is a Perl metric collection adapter module developed by PEVANS’ personal developers. Versions of Metrics::Any::Adapter::SignalFx prior to version 0.04 contained an injection vulnerability. This vulnerability occurred because the labels function did not check for li...

BoxLite path traversal vulnerability

BoxLite is an open-source embedded microvirtual machine runtime developed by BoxLite. It provides hardware-isolated secure sandboxes for AI agents and code execution scenarios. Versions of BoxLite prior to 0.9.0 contained a path traversal vulnerability. This vulnerability stemmed from the lack of...

bit7z path traversal vulnerability

bit7z is a file compression/uncompression tool developed by Riccardo as an individual project. Versions of bit7z prior to 4.0.12 contained a path traversal vulnerability. This vulnerability stemmed from a one-byte error in the SafeOutPathBuilder::restoreSymlink function, which could allow attacke...

Apache OFBiz code injection vulnerability

Apache OFBiz is an ERP system developed by the Apache Foundation in the United States. This system provides a complete set of Java-based web application components and tools. Versions of Apache OFBiz prior to 24.09.07 had a code injection vulnerability. This vulnerability stemmed from improper co...