exploit

The vulnerability affects multiple Qualcomm chipsets due to improper memory handling in firmware. Attackers can exploit this by sending crafted

Eclipse GlassFish version 7.0.15 is vulnerable to Reflected Cross-Site Scripting (XSS) attacks via its Administration Console. The vulnerability arises due

How the CVE Works File Browser’s authentication flaw allows long-lived JWT tokens to remain valid post-logout due to missing server-side

The CVE-2025-12345 vulnerability in the `on-headers` module (versions < 1.1.0) arises due to improper handling of HTTP response headers when

Eclipse GlassFish 6.2.5 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs in specific endpoints.

How the CVE Works: Melange generates SBOM (Software Bill of Materials) files with insecure world-writable permissions (mode 666). This flaw,

The vulnerability in `golang.org/x/oauth2` arises due to improper validation of token syntax during parsing. When a maliciously crafted token is

How the CVE Works The Jenkins Nouvola DiveCloud Plugin (v1.08 and earlier) stores sensitive DiveCloud API keys and credential encryption

How the CVE Works The vulnerability in Multer (versions >= 1.4.4-lts.1, < 2.0.2) arises due to improper error handling when

How the CVE Works The vulnerability exists in WeGIA’s `control.php` endpoint, which fails to properly validate user-supplied input in the

How the CVE Works CVE-2023-23936 is an HTTP request smuggling vulnerability in Node.js due to improper parsing of chunked transfer

How the CVE Works: The vulnerability in DiracX-Web arises from improper validation of the `redirect` parameter in the login page.

Eclipse GlassFish version 7.0.15 is vulnerable to Stored Cross-Site Scripting (XSS) attacks via its Administration Console. The vulnerability arises due

The CVE-2025-XXXX vulnerability in Apko arises due to improper file permissions (mode 0666) set on `/etc/ld.so.cache` and related files. This

How the CVE Works: The CVE-2021-0047 vulnerability in `slice-ring-buffer` stems from improper handling of unsafe Rust code, leading to double-free

How the CVE Works The vulnerability in Filebrowser (CVE-2025-53893) stems from improper memory handling during file read operations. When a

How the CVE Works The vulnerability exists in the `ConfigCommentParserparseJSONLikeConfig` API of @eslint/plugin-kit. The function uses a poorly optimized regular

How the CVE Works CVE-2025-7476 is a critical SQL injection vulnerability in Simple Car Rental System 1.0. The flaw exists

Eclipse GlassFish versions up to 7.0.16 are vulnerable to brute force attacks due to the lack of rate limiting on

How the CVE Works CVE-2025-44177 exploits a directory traversal vulnerability in White Star Software Protop version 4.4.2-2024-11-27. The flaw resides

How the CVE Works The vulnerability in `@nuxtjs/mdc` allows a malicious actor to inject a “ tag via Markdown content.

Livewire versions 3.0.0-beta.1 to 3.6.3 are vulnerable to remote command execution due to improper handling of component property updates during

This CVE exploits a path traversal vulnerability in Filemanager v2.5.0 and below. Attackers craft a malicious HTTP request to filemanager.php,

How the CVE Works The Bitnami `pgpool` Docker image and `postgres-ha` Helm chart default configurations include a user `repmgr` with

The `lastIndexOf(bytes,byte,uint256)` function in OpenZeppelin’s `Bytes.sol` library performs out-of-bounds memory access when two conditions are met: 1. The buffer length

The CVE-2025-XXXX vulnerability in Grafana’s DingDing Alert integration allows users with Viewer permissions to access sensitive alerting configurations due to

The `escapeParameterHtml` option in Vue-i18n (v9.0.0+) fails to fully sanitize interpolated values when rendered via v-html, allowing DOM-based XSS through

How the CVE Works The vulnerability arises during the import of a Simple Archive Format (SAF) package in DSpace. An

How the CVE Works The vulnerability stems from insufficient XML external entity (XXE) disabling in DSpace’s XML parsing during archive

How the CVE Works The vulnerability stems from pyLoad’s unsafe handling of CAPTCHA responses in the `onCaptchaResult()` function. The function

How the CVE Works The vulnerability (CVE-2025-XXXX) in Measured arises due to insufficient input validation in the `Measured::Cache::Json` class initialization.

How the CVE Works Directus Flows with manual triggers fail to validate user permissions before execution. Unauthenticated attackers can manually

How CVE-2025-3792 Works This vulnerability in SeaCMS up to version 13.3 allows remote attackers to execute arbitrary SQL commands via

How the CVE Works The vulnerability arises due to improper input validation in Apache POI when parsing OOXML files (e.g.,

How the CVE Works The vulnerability in WCMS 11 stems from improper input sanitization in the `AnonymousController.php` file, specifically within

How CVE-2025-3798 Works The vulnerability exists in WCMS 11’s Advertisement Image Handler component within app/admin/AdvadminController.php. The `sub` function fails to

How the CVE Works CVE-2025-0154 affects IBM TXSeries for Multiplatforms versions 9.1 and 11.1, allowing remote attackers to access sensitive

How CVE-2025-2547 Works The vulnerability exists in the `/goform/formAdvNetwork` endpoint of D-Link DIR-618 and DIR-605L firmware versions 2.02/3.02. Attackers within

How the CVE Works CVE-2025-23378 affects Dell PowerScale OneFS versions 9.4.0.0 through 9.10.0.0. The vulnerability arises from improper directory listing

How CVE-2025-29985 Works The vulnerability exists in Dell Common Event Enabler (CEE) version 9.0.0.0 due to insecure default initialization in

How the CVE Works CVE-2025-26330 is an incorrect authorization flaw in Dell PowerScale OneFS (versions 9.4.0.0 to 9.10.0.1). An unauthenticated

How the CVE Works CVE-2025-49663 exploits a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS). An attacker

How the CVE Works: CVE-2025-22471 is an integer overflow vulnerability in Dell PowerScale OneFS versions 9.4.0.0 through 9.10.0.1. The flaw

How the CVE Works CVE-2025-49665 is a race condition vulnerability in Workspace Broker where improper synchronization of shared resources enables

How the CVE Works CVE-2025-26479 is an out-of-bounds write vulnerability in Dell PowerScale OneFS versions 9.4.0.0 through 9.10.0.0. The flaw

How the CVE Works CVE-2025-48812 is an out-of-bounds read vulnerability in Microsoft Office Excel. When a maliciously crafted Excel file

How the CVE Works CVE-2025-49664 is an information disclosure vulnerability in the Windows User-Mode Driver Framework (UMDF) Host. The flaw

How the CVE Works: CVE-2025-48811 exploits a missing integrity check in Windows Virtualization-Based Security (VBS) Enclave, allowing a local attacker

How the CVE Works: CVE-2025-48000 is a use-after-free vulnerability in the Windows Connected Devices Platform Service (CDPSvc). This occurs when

How the CVE Works The vulnerability occurs in Directus’ OpenAPI specification endpoint (/server/specs/oas), which exposes the exact version number of

How the CVE Works: CVE-2025-48803 exploits a missing integrity check in Windows Virtualization-Based Security (VBS) Enclave. An authenticated attacker can

How the CVE Works: CVE-2025-48804 exploits a flaw in Windows BitLocker’s data validation mechanism, where untrusted input is improperly accepted

How the CVE Works: CVE-2025-48810 exploits a flaw in Windows Secure Kernel Mode where processor optimization inadvertently removes or modifies

How the CVE Works: CVE-2025-21005 exploits improper access control in the `isemtelephony` component of Android versions prior to Android 15.

How the CVE Works CVE-2025-48808 is a local information disclosure vulnerability in the Windows Kernel. An attacker with low privileges

How the CVE Works: CVE-2025-48806 is a use-after-free vulnerability in Microsoft’s MPEG-2 Video Extension, which handles video decoding. The flaw

How the CVE Works Directus logs all incoming request details in Flow logs when using WebHook triggers, including sensitive session

How the CVE Works Directus Flows allows logging CRUD event data using the “Log to Console” operation with template strings.

How CVE-2025-48809 Works This vulnerability occurs due to improper processor optimization in the Windows Kernel, where security-critical code is either

How the CVE Works CVE-2025-48800 is a vulnerability in Windows BitLocker that allows an attacker with physical access to bypass

How the CVE Works CVE-2025-47999 exploits a missing synchronization flaw in Windows Hyper-V, allowing an adjacent-network attacker to trigger a

How the CVE Works CVE-2025-7471 is a critical SQL injection vulnerability in Modern Bag 1.0, specifically in the `/admin/login-back.php` file.

How the CVE Works CVE-2025-48802 exploits improper certificate validation in Windows Server Message Block (SMB) protocol. An attacker with network

How the CVE Works CVE-2025-48805 is a heap-based buffer overflow vulnerability in Microsoft’s MPEG-2 Video Extension. The flaw occurs when

How the CVE Works The vulnerability in the `resolv` gem stems from insufficient validation of DNS domain name lengths during

How the CVE Works CVE-2025-21007 is an out-of-bounds write vulnerability in `libsavsvc.so` affecting Android versions prior to Android 15. The

How the CVE Works CVE-2025-48003 is a vulnerability in Windows BitLocker that allows an attacker with physical access to bypass