Archive
5 November 2025
Vulnerabilities first published on this day (UTC), newest first.
102 results · Feed
-
High 8.9
DataEase's DB2 is vulnerable to SSRF
DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fi…
-
Medium 6.5
ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. Th…
-
High 7.3
youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects
Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended pr…
-
High 7.3
youki container escape via "masked path" abuse due to mount race conditions
Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixe…
-
High 8.1
HCL DevOps Loop is susceptible to an improper authentication vulnerability
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or ta…
-
High 8.8
Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8…
-
Medium 5.2
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leadin…
-
Medium 6.1
Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are refl…
-
Medium 4.6
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.2 and iPadO…
-
High 8.8CVE-2023-43000 Exploited
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16…
KEV Mar 5, 2026 -
Medium 5.3
QuickJS quickjs.c js_array_buffer_slice buffer over-read
A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local execution. The exploi…
-
High 8.4
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration ru…
-
Medium 5.4
HCL iAutomate is susceptible to a sensitive information disclosure
HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or r…
-
High 8.4
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-c…
-
Medium 6.5
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A success…
-
High 7.3CVE-2025-43990 Public exploit
Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerabili…
-
Medium 6.7
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel …
-
Medium 6.7
Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerabili…
-
Medium 5.3
Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authentica…
-
Critical 9.1
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CL…
-
Medium 5.4
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authentica…
-
Medium 4.3
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obt…
-
Medium 4.8
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authentica…
-
Medium 5.4
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authentica…
-
High 8.4
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run comm…
-
Medium 4.3
Cisco Unified Intelligence Center API Information Disclosure Vulnerability
A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoi…
-
Medium 6.5
Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit…
-
Medium 6.5
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could explo…
-
Critical 9.4
Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability
A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulner…
-
Medium 4.9
Cisco Unified Contact Center Express Arbitrary File Download Vulnerability
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI features.…
-
Critical 9.8
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system. This vulnerability is…
-
High 8.6CVE-2025-20343 Public exploit
Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a…
-
High 8.4
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run comm…
-
Critical 9.1
Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known pas…
-
Critical 9.1
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…
-
High 7.5CVE-2025-64458 Public exploit
Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django…
-
Critical 9.8
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1…
-
High 7.5
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert L…
-
High 7.5
A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouve…
-
High 7.5
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2…