Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into...
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration....
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service...
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive d...
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This ...
Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes....
Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code execution (RCE) via crafted template e...
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the...
Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to ob...
Sales Representative SQL Injection in Groundhogg <= 4.5 versions....
Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions....
Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions....
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions....
Contributor SQL Injection in Contest Gallery <= 30.0.0 versions....
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions....
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions....
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions....
Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions....
Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions....
Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions....
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions....
Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions....
Contributor SQL Injection in WP Job Portal <= 2.5.2 versions....
Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions....