Archive
14 October 2025
Vulnerabilities first published on this day (UTC), newest first.
128 results · Clear filters · Feed
-
Medium 4.3
Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Adobe Connect versions 12.9 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user intera…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be execute…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be execute…
-
Medium 5.4
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be execute…
-
Medium 6.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain un…
-
Medium 4.8
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnera…
-
Medium 5.9
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized rea…
-
Medium 6.4
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerS…
-
Medium 5.5
NVIDIA Jetson Linux and IGX OS contain a vulnerability in NvMap, where improper tracking of memory allocations could al…
-
Medium 5.5
Substance3D - Viewer | Out-of-bounds Write (CWE-787)
Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to crash the application or make it unavailable. Exploitation…
-
Medium 4.9
Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through car…
-
Medium 4.9
Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through car…
-
Medium 5.5
Microsoft Failover Cluster Virtual Driver Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Search Service Denial of Service Vulnerability
Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
-
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.5
Microsoft Office Denial of Service Vulnerability
Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.
-
Medium 6.5
Microsoft Windows File Explorer Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.5
Windows Push Notification Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows State Repository API Server File Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.
-
Medium 5.0
Windows Search Service Denial of Service Vulnerability
Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
-
Medium 5.5
Windows ETL Channel Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Search Service Denial of Service Vulnerability
Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.
-
Medium 5.5
Microsoft Failover Cluster Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose information locally.
-
Medium 5.5
Storage Spaces Direct Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Windows File Explorer Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows WLAN AutoConfig Service Information Disclosure Vulnerability
Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
-
Medium 6.1
Windows BitLocker Security Feature Bypass Vulnerability
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
-
Medium 5.1
Windows Kernel Information Disclosure Vulnerability
Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.
-
Medium 6.1
Windows BitLocker Security Feature Bypass Vulnerability
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
-
Medium 6.2
Windows Kernel Security Feature Bypass Vulnerability
Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.
-
Medium 6.1
Windows BitLocker Security Feature Bypass Vulnerability
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
-
Medium 6.1
Windows BitLocker Security Feature Bypass Vulnerability
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
-
Medium 4.8
.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
-
Medium 6.3
Virtual Secure Mode Spoofing Vulnerability
Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.
-
Medium 5.3
Playwright Spoofing Vulnerability
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
-
Medium 5.5
Microsoft Failover Cluster Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows Failover Cluster allows an authorized attacker to disclose information locally.
-
Medium 6.5
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.