OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.
OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring configuration.
OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.
OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution.
simple-git Node.js library has a command injection vulnerability (EPSS with patch) enabling RCE when processing untrusted git operations.
GetSimple CMS massiveAdmin plugin has a CSRF vulnerability enabling attackers to perform admin actions through crafted malicious pages.
Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications.
Siemens devices have a stored XSS in trace file handling (CVSS 9.6) enabling code execution when administrators view diagnostic data.
Parse Server has a CVSS 10.0 access control vulnerability enabling complete bypass of all data access restrictions.
Android DeviceId component has a CVSS 10.0 out-of-bounds write in persistence handling enabling device compromise.
Modem has a fifth OOB write enabling remote privilege escalation.
Samsung/Google MFC driver has an OOB write in mfc_core_isr.c enabling kernel-level privilege escalation on Android devices.
Modem has a fourth OOB write due to incorrect bounds check.
Modem has a third OOB write in cell broadcast utilities.
Modem OOB write in cell broadcast utilities enabling privilege escalation.
Samsung/Qualcomm modem has an out-of-bounds write in NR SM message handling enabling privilege escalation through crafted cellular signaling.
LimeSurvey before v6.15.0 has an insecure deserialization enabling remote code execution through crafted survey data.
A Siemens product has a command injection vulnerability enabling remote code execution.
Tutor LMS Pro WordPress plugin has an authentication bypass enabling unauthenticated users to access premium learning content and admin functions.
Coral Server open collaboration platform has a missing authorization enabling unauthenticated access to all collaboration data.
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit.
A product has an access control flaw allowing activation token reuse on the password-reset endpoint for unauthorized account takeover.
Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API.
rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities.
Gas station automation system BUK TS-G 2.9.1 has a SQL injection enabling compromise of fuel management and transaction data.
SiYuan prior to 3.5.10 has a path traversal vulnerability enabling arbitrary file access through crafted API requests.
Coral Server has a third missing authorization flaw.
Parse Server has a third vulnerability with missing authorization enabling unauthorized operations.
Coral Server has an IDOR vulnerability enabling cross-user data access.
SAP NetWeaver Enterprise Portal Administration has an insecure deserialization vulnerability allowing privileged users to execute code through uploaded files.
Hitachi Vantara Pentaho has a missing authorization vulnerability enabling unauthorized access to data integration and analytics functions.
A product has missing 2FA rate limiting allowing unlimited brute-force attempts against two-factor authentication codes.
Appsmith platform prior to version 1.96 has a critical stored XSS enabling account takeover through crafted admin panel content.
MCP Atlassian server has a path traversal vulnerability enabling unauthorized access to Confluence and Jira data outside the intended scope.