Adobe InDesign Desktop security vulnerabilities

Adobe InDesign Desktop is a professional desktop publishing software, primarily used for page design, printing, and digital publishing. Adobe InDesign Desktop has a heap buffer overflow vulnerability, which stems from improper handling of certain file data, leading to out-of-bound writes to the...

FreeSWITCH security vulnerabilities

FreeSWITCH is a free and open-source communication software developed by Anthony Minessale, an individual developer from the United States. This software can be used to create audio, video, and messaging-related products and applications. Prior to FreeSWITCH version 1.11.1, there were security...

Microsoft DWM Core Library resource management error vulnerability

The Microsoft DWM Core Library is a core library of Microsoft Windows from the company Microsoft. There is a resource management vulnerability in the Microsoft DWM Core Library. Attackers can exploit this vulnerability to gain higher privileges. The following products and versions are affected:...

MongoDB Server log information leakage vulnerability

MongoDB Server is an open-source NoSQL database developed by MongoDB, a US-based company. This database offers features such as collection-oriented storage, dynamic querying, data replication, and automatic failover. There is a vulnerability in MongoDB Server where log information may be leaked...

SAP Business Objects Business Intelligence Platform Access Control Vulnerability

SAP Business Objects Business Intelligence Platform is a set of business intelligence software and enterprise performance solutions provided by the German company SAP. This product includes features such as report generation, analysis, and data visualization. There is an access control...

Microsoft Office Excel buffer error vulnerability

Microsoft Office Excel is a spreadsheet software developed by Microsoft in the United States. There is a security vulnerability in Microsoft Office Excel, which stems from integer underflow. This vulnerability may allow unauthorized attackers to execute code locally...

Microsoft Windows Network Controller (NC) resource management error vulnerabilities

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. There is a resource management vulnerability in Microsoft Windows. Attackers have exploited this vulnerability, causing a denial-of-service attack on the system. The following products and version...

FreeSWITCH authorization issue vulnerability

FreeSWITCH is a free and open-source communication software developed by Anthony Minessale, an individual developer from the United States. This software can be used to create audio, video, and short message-based products and applications. Prior to FreeSWITCH version 1.11.1, there was an...

Red Hat 389 Directory Server buffer error vulnerability

389 Directory Server is an open-source implementation of a highly available, fully functional, reliable, and secure LDAP server. There is a security vulnerability in 389 Directory Server. This vulnerability stems from the checkPrefix function in the pw.c module, which copies the algorithm ID...

Tenda O3 buffer error vulnerability

The Tenda O3 is an outdoor wireless bridge produced by the Chinese company Tenda. Version 1.0.0.54180 of the Tenda O3 has a security vulnerability. This vulnerability stems from a stack overflow issue with the username parameter in the R7WebsSecurityHandler function, which could allow attackers t...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word is a word processing software developed by Microsoft and open sourced. There are security vulnerabilities in Microsoft Office Word. Attackers can exploit these vulnerabilities to obtain sensitive information. The following products and versions are affected: Microsoft 365 Ap...

Microsoft Active Directory Domain Services Buffer Error Vulnerability

Microsoft Active Directory Domain Services is a key service provided by Microsoft Corporation in the United States. It is used to manage and organize resources, users, computers, and other security objects within a network. There are security vulnerabilities associated with Microsoft Active...

Microsoft Windows UI Automation Manager (uiamanager.dll) race condition vulnerability

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. There is a vulnerability related to the Microsoft Windows UI Automation Manager uiamanager.dll. Attackers can exploit this vulnerability to gain higher privileges. The following products and...

Microsoft Windows Boot Manager processing logic vulnerability

Microsoft Windows Boot Manager is a UEFI application provided by Microsoft Corporation, used to configure the boot environment. There are security vulnerabilities in Microsoft Windows Boot Manager. Attackers can exploit these vulnerabilities to bypass certain functions. The following products and...

Fortinet’s various products have vulnerabilities related to operating system command injection.

FortiSandbox is a security sandbox product provided by Fortinet, primarily used for detecting and analyzing malware. Fortinet FortiSandbox has a vulnerability related to OS command injection. This vulnerability stems from an inability to properly neutralize the special elements used in OS command...

DesDev DedeCMS command injection vulnerability

DesDev DedeCMS is an open-source content management system CMS developed by DesDev Corporation in China. It is built using PHP. This system offers functions such as content publishing, content management, content editing, and content retrieval. Version 5.7.118 of DesDev DedeCMS contains a securit...

Microsoft Windows Secure Boot processing logic vulnerability

Microsoft Windows Secure Boot is a security boot feature provided by Microsoft Corporation. There are security vulnerabilities associated with Microsoft Windows Secure Boot. Attackers can exploit these vulnerabilities to bypass certain features. The following products and versions are affected:...

Adobe Acrobat Reader resource management error vulnerability

Adobe Acrobat Reader is a PDF viewer developed by Adobe Inc. in the United States. This software is used for printing, signing, and annotating PDF documents. Versions of Adobe Acrobat Reader such as 24.001.30365, 26.001.21651, and earlier versions have a resource management vulnerability that ste...

Adobe Dreamweaver Desktop: Input validation error vulnerability

Adobe Dreamweaver Desktop is a web design and development software provided by Adobe, a company based in America. Versions of Adobe Dreamweaver Desktop starting from 21.7 and earlier have a vulnerability related to input validation. This vulnerability arises due to improper input validation, whic...

Microsoft Windows BitLocker permission and access control vulnerabilities

Microsoft Windows BitLocker is a security feature provided by Microsoft that ensures the recovery key is backed up and secure before it is activated. There is an access control vulnerability in Microsoft Windows BitLocker. Attackers can exploit this vulnerability to bypass certain features. The...

VMware Spring Framework code-related vulnerabilities

VMware Spring Framework is an open-source Java and JavaEE application framework developed by VMware, Inc. This framework helps developers build high-quality applications. Versions of the VMware Spring Framework prior to 7.0.0, 6.2.0, 6.1.0, and 5.3.0 contain code vulnerabilities. These...

Spring Framework security vulnerabilities

The Spring Framework is an application development framework developed by Spring in a open-source manner. There are security vulnerabilities in Spring Framework versions 7.0.0 and earlier, 6.2.0 and earlier, 6.1.0 and earlier, and 5.3.0 and earlier. These vulnerabilities stem from the SpEL...

Snipe-IT security vulnerabilities

Snipe-IT is a set of open-source IT asset/license management systems developed by Grokability. Versions of Snipe-IT prior to 8.6.0 contained security vulnerabilities. These vulnerabilities stemmed from the ability for non-administrator users to have the "users.edit" permission, allowing them to...

Google Chrome: Input validation error vulnerability

Google Chrome is a web browser developed by Google Inc. of the United States. Google Chrome has a vulnerability related to input validation, which stems from insufficient validation of untrusted inputs...

jflyfox jfinal_cms injection vulnerability

jfinalcms is a content management system used for managing website sections, articles, and feedback content. jflyfox jfinalcms has a SQL injection vulnerability. The vulnerability arises due to the list function in the AdvicefeedbackController.java file not properly filtering the orderBy paramete...

WordPress plugin Squirrly SEO Plugin has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

TP-Link Tapo C520WS security vulnerabilities

The Tapo C520WS v2 is a TP-Link network camera used for video surveillance and ONVIF device management. The Tapo C520WS v2 has a stack buffer overflow vulnerability. This vulnerability arises due to a lack of valid boundary checks when the ONVIF CreateUsers service processes XML user nodes...

Lyrion Music Server Cross-Site Script Vulnerability

Lyrion Music Server is an audio server software developed by the Lyrion organization. Version 9.2.0 of Lyrion Music Server contains a cross-site scripting vulnerability. This vulnerability stems from an unvalidated storage-based cross-site scripting flaw present in the log viewer, which may allow...

Zephyr security vulnerabilities

Zephyr is an open-source, scalable real-time operating system RTOS developed by Zephyr. There is a security vulnerability in Zephyr, which stems from the fact that the tlssessionstore and tlssessionrestore functions in the TLS socket connection path do not validate the addrlen value. This leads t...

Node Version Manager security vulnerability

Node Version Manager is an open-source node version manager developed by nvm.sh. Versions of Node Version Manager prior to 0.40.4 contain security vulnerabilities. These vulnerabilities stem from the ability to execute arbitrary commands from the configured image version string. The functions...

MBS multiple products have path traversal vulnerabilities

MBS Single-A and other products are a series of industrial communication gateways developed by the German company MBS. Several MBS products have a path traversal vulnerability. This vulnerability stems from the insufficient input validation in the ugw-logread method, which may allow remote...

Google Chrome security vulnerabilities

Google Chrome is a web browser developed by the American company Google. Google Chrome has a security vulnerability, which stems from insufficient validation of untrusted inputs by the Cast component...

DesDev DedeCMS code-related vulnerabilities

DesDev DedeCMS is an open-source content management system CMS developed by DesDev Corporation, based on PHP. This system offers functions such as content publishing, content management, content editing, and content retrieval. Version 5.7.88 of DesDev DedeCMS contains a code vulnerability. This...

FlexRIC security vulnerabilities

FlexRIC is an open-source RAN intelligent controller developed by Mosaic5G. The FlexRIC v2.0.0 version contains a security vulnerability. This vulnerability arises from trusting the xappid field in the trust E42 message without binding it to the sender’s SCTP association. As a result, remote...

MediaTek Chipsets Security Vulnerabilities

MediaTek Chipsets are a series of chips developed by MediaTek Corporation in China. The MediaTek Chipsets contain security vulnerabilities, which stem from buffer overflow attacks. These vulnerabilities may lead to remote code execution, requiring user execution privileges for exploitation...

droidclaw security vulnerabilities

Droidclaw is an open-source AI tool developed by Unitedby AI U/AI, which allows for control of Android phones through natural language commands. Droidclaw versions 0.5.3 and earlier contain security vulnerabilities. These vulnerabilities stem from an improper limit on the number of authentication...

Google Android security vulnerabilities

Google Android is an open-source operating system based on Linux, developed by Google Inc. There are security vulnerabilities in Google Android, which stem from integer overflows in multiple functions within ubsanthrowingruntime.cpp. These vulnerabilities may lead to local persistent...

OTRS security vulnerabilities

OTRS is a service management solution developed by the German company OTRS. Vulnerabilities exist in OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X up to version 2026.4.X, as well as in the Community Edition 6.0.x version. These vulnerabilities stem from improper input validation ...

Nautobot security vulnerabilities

Nautobot is a web-based automation platform developed by the Nautobot team. Versions of Nautobot prior to 2.4.33 and 3.1.2 contained security vulnerabilities. These vulnerabilities stemmed from users who had permission to add/modify GitRepository records being able to directly set the currenthead...

TP-Link’s various products have security vulnerabilities

TP-Link Tapo L535E are products of the TP-Link company from China. The TP-Link Tapo L535E is a smart color-adjustable LED bulb. The TP-Link Tapo P300 is a smart Wi-Fi multi-port plug-in device. The TP-Link Tapo D100C is a smart video doorbell with a wireless doorbell buzzer. Several TP-Link...

WordPress plugin Advanced Custom Fields: Extended security vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Canonical Ubuntu Linux security vulnerabilities

Canonical Ubuntu Linux is a Linux operating system developed by the British company Canonical. The Canonical Ubuntu Linux 6.8 version contained a security vulnerability. This vulnerability stemmed from the AppArmor AFINET/AFINET6 socket mediation code, where uninitialized variables might have bee...

OpenStack Swift security vulnerabilities

OpenStack Swift is an open-source distributed object storage system under OpenStack. There were security vulnerabilities in versions of OpenStack Swift prior to 2.36.2 and 2.37.2. These vulnerabilities stemmed from the s3api middleware handling truncated aws-chunked PUT request bodies, leading to...

WordPress plugin CM Ad Changer has a cross-site request forgeing vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper transaction splitting during direct I/O completion in ocfs2, potentially leading to...

Gradio security vulnerabilities

Gradio is an open-source Python library developed by Google. It provides a user-friendly web interface for demonstrating machine learning models. Prior to version 6.15.0, Gradio had a security vulnerability. This vulnerability stemmed from the use of shared module-level HTTP clients, which allowe...

Northern.tech Mender Server security vulnerability

Northern.tech Mender Server is an IoT server-side software developed by the American company Northern.tech. Versions of Northern.tech Mender Server such as 4.1.0, 4.0.1, and earlier have security vulnerabilities, which are due to a vulnerability that makes the system susceptible to directory...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the gfs2 module failing to remove quota data objects from the LRU list in the qdput function. Thi...

GnuTLS trust management issue vulnerabilities

GnuTLS is an open-source, free security communication library developed by GnuTLS. GnuTLS has a trust management vulnerability, which stems from the certificate verification process. Customized certificates may cause incorrect backtracking during the verification of the common name field,...

Bugsink security vulnerabilities

Bugsink is an open-source, self-hosted bug tracking software developed by Bugsink. Versions of Bugsink prior to 2.2.0 contained security vulnerabilities. These vulnerabilities stemmed from the issue where batch operations did not require the submission of issue IDs belonging to the same project...