Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network....
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally....
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network....
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network....
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network....
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network....
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network....
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network....
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network....
Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begi...
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product pa...
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_...
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and ema...
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage ori...
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification ...
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() b...
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via t...
Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability....
Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability....
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound co...
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone val...
Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability....
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. A...
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with...