CVE Records

D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection

Microsoft Office Security Feature Bypass Vulnerability

D-Link DCS700l Web Form setDayNightMode command injection

SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

Sangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injection

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

Cisco Unified Communications Products Remote Code Execution Vulnerability

GNU InetUtils Argument Injection Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Zoom Node Deployments - Command Injection

Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element

Chainlit < 2.9.4 Arbitrary File Read via /project/element

Tosei Online Store Management System ネット店舗管理システム imode_alldata.php command injection

D-Link DIR-823X set_wifidog_settings sub_412E7C command injection

kalcaddle kodbox Compression zip command injection

REC in MCPJam inspector due to HTTP Endpoint exposes

WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

NTLM Hash Disclosure Spoofing Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft SharePoint Remote Code Execution Vulnerability

NTLM Hash Disclosure Spoofing Vulnerability

Desktop Window Manager Information Disclosure Vulnerability

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi

OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read

D-Link DI-8200G upgrade_filter.asp command injection

OWASP CRS has multipart bypass using multiple content-type parts

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

-

Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Langflow Missing Authentication on Critical API Endpoints

Upload Arbitrary Files

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

n8n Vulnerable to Remote Code Execution via Expression Injection

Zlib compressed protocol header length confusion may allow memory read

WatchGuard Firebox iked Out of Bounds Write Vulnerability

SonicWall SMA1000 Missing Authorization Vulnerability

RoundCube Webmail Cross-site Scripting Vulnerability

Apple Multiple Products Use-After-Free WebKit Vulnerability

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

ASUS Live Update Embedded Malicious Code Vulnerability

Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

Gladinet CentreStack and TrioFox Hard Coded AES Keys

Apple Multiple Products Improper Locking Vulnerability

Apple Multiple Products Classic Buffer Overflow Vulnerability

Google Chromium Out of Bounds Memory Access Vulnerability

File overwrite in file update API in Gogs

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Android Framework Information Disclosure Vulnerability

Android Framework Privilege Escalation Vulnerability

Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

Array Networks ArrayOS AG OS Command Injection Vulnerability

Meta React Server Components Remote Code Execution Vulnerability

Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Fortinet FortiWeb OS Command Injection Vulnerability

Google Chromium V8 Type Confusion Vulnerability

Fortinet FortiWeb Path Traversal Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Host Process for Windows Tasks Elevation of Privilege Vulnerability

Gladinet Triofox Improper Access Control Vulnerability

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

Apple Multiple products Use-After-Free Vulnerability

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

BigIP APM Vulnerability

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Windows Agere Modem Driver Elevation of Privilege Vulnerability

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Gladinet CentreStack and TrioFox Local File Inclusion Flaw

Oracle E-Business Suite Unspecified Vulnerability

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Google Chromium V8 Type Confusion Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

Libraesva Email Security Gateway Command Injection Vulnerability

CWP Control Web Panel OS Command Injection Vulnerability

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

WatchGuard Firebox iked Out of Bounds Write Vulnerability

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Adobe Commerce | Improper Input Validation (CWE-20)

tls: fix handling of zero-length records on the rx_list

Android Runtime Use-After-Free Vulnerability

Sitecore Products ViewState Deserialization Vulnerability

Authenticated RCE via Parental Control command injection

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service