exploit

This vulnerability exists within the shard movement and file replication functionality of the Weaviate database. During the process of transferring

The vulnerability resides in the `APIVersion` rule of the affected component, which used the insecure JavaScript `new Function()` constructor to

The vulnerability in Apache StreamPark stems from the use of AES encryption in ECB (Electronic Codebook) mode combined with a

This vulnerability in Apache StreamPark stems from the use of a static, hard-coded encryption key within the application’s codebase for

The CVE-2024-39956 vulnerability in NeuVector arises from the default disabling of TLS certificate verification for OpenID Connect authentication and other

The CVE-2018-4063 vulnerability is an unrestricted upload of a dangerous file type in the `upload.cgi` component of Sierra Wireless AirLink

This vulnerability is an incomplete fix for CVE-2025-55184 in the React Server Components (RSC) protocol. A malicious actor can craft

How the mentioned vulnerability works: The vulnerability in FoF Pretty Mail version 1.1.2 is a server-side template injection (SSTI) that

The vulnerability exists within the `@vitejs/plugin-rsc` plugin’s integration of `react-server-dom-webpack` for processing React Server Components (RSCs). In affected versions prior

How the mentioned CVE works: The vulnerability is in the PLAIN restore meta-command filter added to pgAdmin to fix CVE-2025-12762.

This vulnerability, CVE-2025-53015, targets the HugeGraph-Server’s RAFT-based PD (Placement Driver) store. The cluster communication for metadata uses the Hessian protocol

CVE-2024-43608 exploits a vulnerability in react-server-dom-webpack versions prior to 19.2.3, where improper handling of server-side rendering contexts allows unauthorized access

The vulnerability arises from an incomplete patch for CVE-2025-55184 in React Server Components (RSC), allowing denial of service via resource

The vulnerability in React Server Components stems from a flaw in the serialization process during server-side rendering. In affected versions,

CVE-2025-55183 exploits a flaw in Next.js App Router endpoints using Server Actions. In affected versions, when a malicious HTTP request

A denial-of-service vulnerability exists within the React Server Components (RSC) rendering engine in affected versions. The flaw is triggered during

The vulnerability CVE-2025-55184 exploits a flaw in the deserialization process of React Server Components within Next.js App Router endpoints. A

The CVE-2025-34333 vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances. Affected versions include all releases up to and

How the CVE Works: This vulnerability is a server-side template injection (SSTI) flaw in Elastic Cloud Enterprise’s (ECE) use of

The vulnerability exists in the web administration component of AudioCodes Fax Server and Auto-Attendant IVR appliances. When an administrator performs

The CVE-2025-34335 vulnerability exists within the license activation functionality of AudioCodes Fax Server and Auto-Attendant IVR appliances. The flaw is

The vulnerability CVE-2025-59945 affects the SysReptor pentest reporting platform. It exists in versions starting from 2024.74 up to, but not

The vulnerability CVE-2025-37736 is an improper authorization flaw (CWE-863) in Elastic Cloud Enterprise (ECE). The built-in `readonly` user account, which

The vulnerability CVE-2025-63214 is caused by an improper access control (CWE-284) flaw within the account management functions of the bridgetech

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the SysReptor pentest reporting platform for versions prior to 2025.102.

How the Mentioned CVE Works The vulnerability is an authenticated command injection in the fax test functionality of AudioCodes appliances.

The vulnerability exists in the Texas Instruments AM65x CPSW NUSS Ethernet driver within the Linux kernel. For TI System-on-Chips (SoCs)

The vulnerability CVE-2025-8897 is a Reflected Cross-Site Scripting (XSS) flaw in the Beaver Builder WordPress page builder plugin. It exists

The vulnerability CVE-2025-11726 in the Beaver Builder plugin stems from missing authorization checks in its REST API. Specifically, the endpoints

This vulnerability is a NULL pointer dereference (CWE-476) in the Linux kernel’s NUMA (Non-Uniform Memory Access) initialization code. During system

How the CVE Works The vulnerability exists in the library’s feature for downloading a specific subdirectory from a remote source,

The vulnerability CVE-2025-39875 is a NULL pointer dereference flaw within the `igb` network driver of the Linux kernel. It is

How the CVE Works (CVE-2025-47914) The vulnerability exists within the SSH Agent’s process for handling new key identity requests. The

How the CVE Works The vulnerability occurs in the Linux kernel’s `tracing/osnoise` subsystem. When a user writes to the `/sys/kernel/debug/tracing/osnoise/cpus`

How the CVE Works The vulnerability is a logic error introduced during code refactoring in the Linux kernel’s Ceph filesystem

Traefik, an HTTP reverse proxy and load balancer, contains a path normalization vulnerability in versions prior to 2.11.32 and from

The vulnerability exists in the `exportInstallTable` function within the `/app/utils/base/database/Migrate.php` file of YiFang CMS versions up to and including 2.0.5.

The CVE-2025-14285 vulnerability exists within the `edit_personnel.php` file of the Code-Projects Employee Profile Management System version 1.0. The flaw stems

The vulnerability exists within the `mergeMultipartUpload` function of the `/app/utils/base/plugin/P_file.php` file in YiFang CMS versions up to and including 2.0.5.

How the CVE Works The vulnerability is an improper limitation of a pathname, classified as CWE-22 Path Traversal. In affected

The vulnerability CVE-2025-66470 is a Cross-Site Scripting (XSS) flaw in the NiceGUI Python framework, affecting versions 3.3.1 and earlier. It

The vulnerability exploits the GeoServer WMS GetMap endpoint at /geoserver/wms, which accepts XML input without proper sanitization. When an XML

The vulnerability exists in the `HttpClient.java` component of Dreampie Resty’s HTTP client module. The flaw is specifically located within the

How the CVE Works The vulnerability exists in the `app/logic/L_tool.php` file of YiFang CMS versions up to 2.0.5. The flaw

The vulnerability CVE-2025-66481 in DeepChat (versions 0.5.1 and below) stems from insufficient sanitization of user-supplied Mermaid diagram content. The application’s

The vulnerability CVE-2025-11136 exists in the `webUploader` function within the file `/app/app/controller/File.php` of the YiFang CMS backend component. This function

How the CVE Works The vulnerability exists in the HTTP Host Header Handler within the file `Hush\hush-lib\hush\Util.php` of jameschz Hush

The CVE-2025-58181 vulnerability exists within SSH server implementations that support GSSAPI (Generic Security Services Application Program Interface) for authentication. During

The CVE-2025-39926 vulnerability is a logic flaw within the `genl_bind()` function of the Linux kernel’s genetlink subsystem. Genetlink provides a

The vulnerability CVE-2025-63932 is an unauthenticated Remote Code Execution flaw in the D-Link DIR-868L A1 router, specifically in firmware version

How the mentioned CVE works: The vulnerability is in the `spi-microchip-core-qspi` driver of the Linux kernel. A code change intended

The vulnerability CVE-2025-53840 in Icinga DB Web stems from an improper implementation of access control filters within the dependency map

The vulnerability exists in the `mt76` WiFi driver for MediaTek MT7996 chipsets within the Linux kernel. It stems from a

How the CVE Works This vulnerability exists in the web interface of Icinga DB, a monitoring system component. Authorized users

The Express.js framework provides the express.json() middleware for parsing JSON request bodies. By default, without a specified size limit, this

The CVE-2025-39924 vulnerability exists within the Enhanced Read-Only File System (erofs) component of the Linux kernel. It specifically concerns the

This vulnerability exists in the Linux kernel’s Controller Area Network (CAN) J1939 protocol implementation. The issue is a use-after-free flaw

How the CVE Works The vulnerability exists in the `ixgbe` network driver within the Linux kernel. Its Energy Efficient Ethernet

The vulnerability CVE-2025-14182 is a classic path traversal (CWE-22) flaw in the Sobey Media Convergence System, versions 2.0 and 2.1.

How the Mentioned CVE Works (CVE-2025-66565) Fiber Utils provides common functions for the Fiber web framework. The vulnerability exists in

A use-after-free vulnerability exists in the WebRTC Signaling component of affected Mozilla products. This memory corruption flaw, classified as CWE-416,

The CVE-2025-13248 vulnerability exists within the SourceCodester Patients Waiting Area Queue Management System, version 1.0. The specific flaw is located

This vulnerability is a post-authentication flaw in MongoDB’s network two-phase commit protocol, which coordinates transactions across different database shards. The

The vulnerability in @tiptap/extension-link before version 2.10.4 is a DOM-based Cross-site Scripting (XSS) flaw. It originates from the extension’s failure

The vulnerability CVE-2025-14286 is an information disclosure flaw in the Tenda AC9 router’s web management interface. It resides in an

The vulnerability stems from an internal API endpoint (/api/internal/sftp-event) designed for communication between AzuraCast’s core application and its internal SFTP

The vulnerability CVE-2025-14518 is a Server-Side Request Forgery (SSRF) in PowerJob versions up to 5.1.2. It exists in the `checkConnectivity`

How the CVE Works: The vulnerability exists in the quic-go library’s HTTP/3 implementation. It improperly handles QPACK header compression. An

How the CVE Works: This vulnerability exploits the HTTP/2 protocol’s stream cancellation feature. An attacker can open numerous HTTP/2 streams

This vulnerability is a stored (persistent) Cross-Site Scripting (XSS) flaw within the device’s web-based management interface. An attacker can inject

The vulnerability in WBCE CMS version 1.6.4 is a flaw in its brute-force protection mechanism. The application tracks failed login

The vulnerability CVE-2025-67487 in Static Web Server (SWS) versions 2.40.0 and below is a path traversal flaw caused by inadequate

The vulnerability is a stored cross-site scripting (XSS) flaw in the web interface of Lyrion Music Server versions 9.0.3 and

The vulnerability CVE-2025-14200 is a Cross-Site Scripting (XSS) flaw within the `usersub.php` file of the Hotel Management System’s “Request Pending

How the CVE Works The `xmlseclibs` PHP library uses libxml2 to canonicalize (standardize) XML data during signature validation. A flaw

The vulnerability in NiceGUI versions 3.3.1 and below is a reflected Cross-Site Scripting (XSS) flaw in the ui.add_css, ui.add_scss, and

How the CVE Works The vulnerability exists in the `alphapd` component of the D-Link DCS-930L IP camera firmware version 1.15.04.

The vulnerability is a logic flaw in how Astro middleware processed and normalized URL paths for authentication checks. A previous

This vulnerability exploits a insecure deserialization flaw within the SnakeYAML library used by the HummerRisk platform. Attackers with standard user

The vulnerability is an algorithmic complexity issue in the `django.core.serializers.xml_serializer.getInnerText()` function. When the XML deserializer processes input, this function recursively

The vulnerability CVE-2025-54154 is an improper authentication (CWE-287) flaw within QNAP Authenticator mobile app versions prior to 1.3.1.1227. Its operation

The vulnerability in the Okta Java SDK arises from inadequate thread management in multithreaded implementations. When the SDK processes requests,

The vulnerability exists in the TokenRequestCache mechanism of the Auth0 Next.js SDK (versions 4.11.0-4.11.1 and 4.12.0). When the SDK processes

The vulnerability (CVE-2025-XXXXX/GHSA-XXXX) in the Okta Java SDK stems from a race condition within the shared `ApiClient` instance when handling

The vulnerability CVE-2025-14086 exists within the `/app-api/v1/members/openid/` endpoint of the youlaitech youlai-mall e-commerce platform. It stems from insufficient access controls

The vulnerability CVE-2025-52856 is an improper authentication (CWE-287) flaw in the QVR firmware for legacy QNAP VioStor Network Video Recorders

How the mentioned CVE works: The vulnerability CVE-2025-64053 is a classic buffer overflow in the web management interface of Fanvil

How the CVE Works A race condition exists in the Linux kernel’s Ceph filesystem client. During concurrent operations like file

How the Mentioned CVE Works The vulnerability (CVE-2025-35916) in the `sd` command-line search-and-replace tool stems from its file operation logic.

The CVE-2025-14090 vulnerability is a SQL injection flaw within the AMTT Hotel Broadband Operation System version 1.0. The specific point

The vulnerability CVE-2025-14092 is an OS command injection flaw within the `sub_416898` function of the `/boafrm/formDebugDiagnosticRun` file in the Edimax

This vulnerability exists in the `/app-api/v1/orders/` API endpoint of Youlai-Mall versions 1.0.0 and 2.0.0. The flaw is an improper control

How the Mentioned CVE Works The vulnerability exists in the `rtl9300_i2c_config_xfer` function within the Linux kernel’s I2C driver for Realtek

The CSRF vulnerability in 1Panel’s web port configuration functionality arises due to insufficient validation mechanisms on the port-change endpoint. Specifically,

How the Mentioned CVE Works The vulnerability CVE-2025-64057 is a path traversal flaw in the web interface of the Fanvil

How the CVE-2025-64052 Vulnerability Works The CVE-2025-64052 vulnerability is a critical command injection flaw in the Fanvil x210 V2 IP

The vulnerability is a cross-site request forgery (CSRF) in the panel name management functionality of 1Panel. The affected endpoint does

The vulnerability in the Auth0 Next.js SDK involves improper input validation of the returnTo parameter during OAuth authentication flows. In

In Jenkins, build authorization tokens are used to authenticate remote build triggers via HTTP requests. These tokens are intended to

The CVE-2025-36140 vulnerability in IBM watsonx.data stems from a lack of resource allocation limits for its ingestion pods. In Kubernetes