CVE Watchtower

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error pa...

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds rea...

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vec...

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS D...

Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for anothe...

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member ...

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an org...

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product ...

Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another p...

Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in ...

Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.

A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassi...

SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operat...

The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not...

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order sh...

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated u...

An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a ...

A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained w...

The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result...

An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. Th...