Archive
August 2025
Vulnerabilities first published in this month (UTC), newest first.
1,498 results · Clear filters · Feed
-
Medium 5.9
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker …
-
Medium 5.9
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker …
-
Medium 5.3
Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTor…
-
Medium 6.5
-
Medium 6.5
-
Medium 4.3
-
Medium 6.5
Vault LDAP MFA Enforcement Bypass When Using Username As Alias
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault …
-
Medium 5.3
GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CV…
-
Medium 5.1
Cross-Site Request Forgery (CSRF) allowed remote control of Elgato Key Lights
A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles the victim's lights.
-
Medium 5.5
Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks
Information disclosure while processing a packet at EAVB BE side with invalid header length.
-
Medium 5.5
Leftover Debug Code in Secure Element
Information disclosure while capturing logs as eSE debug messages are logged.
-
Medium 6.5
Out-of-bounds Read in Core
Information disclosure while processing the hash segment in an MBN file.
-
Medium 6.5
Out-of-bounds Read in Core
Information disclosure while reading data from an image using specified offset and size parameters.
-
Medium 6.1
Buffer Over-read in Automotive OS Platform Android
Information disclosure while opening a fastrpc session when domain is not sanitized.
-
Medium 6.0
Race Condition in Shopware Voucher Submission
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.
-
Medium 6.4
Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attribu…
-
Medium 5.9
Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS
Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubis…
-
Medium 5.7
Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attacker…
-
Medium 5.7
Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged …
-
Medium 5.5
Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung H…
-
Medium 4.4
Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bo…
-
Medium 6.3
Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged at…
-
Medium 4.3
Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 all…
-
Medium 4.0
Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document …
-
Medium 4.3
Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attacker…
-
Medium 6.2
Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to …
-
Medium 5.5
Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to mo…
-
Medium 5.5
Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to …
-
Medium 6.0
Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to de…
-
Medium 4.0
Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to acces…
-
Medium 6.4
Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att…
-
Medium 6.4
Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and including, 2.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for …
-
Medium 5.4
Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content
The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes…
-
Medium 4.8
Race condition vulnerability in the kernel hufs module. Impact: Successful exploitation of this vulnerability may affec…
-
Medium 4.2
Improper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vuln…
-
Medium 4.5
Vulnerability of using incompatible types to access resources in the location service. Impact: Successful exploitation …
-
Medium 5.4
Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of …
-
Medium 5.4
Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of …
-
Medium 5.1
Vulnerability of inadequate packet length check in the BLE module. Impact: Successful exploitation of this vulnerabilit…
-
Medium 5.0
Out-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successf…