Archive
28 November 2025
Vulnerabilities first published on this day (UTC), newest first.
43 results · Feed
-
Medium 6.5
Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affe…
-
High 8.8
org.lz4:lz4-java - Out-of-Bounds Memory Access
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
-
Medium 5.9
Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers…
-
Medium 5.3
Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins
Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
-
Medium 5.4
Apache Kvrocks: RESET command grants admin privileges
Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
-
High 8.0
Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()
Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filte…
-
Unscored —
rustls-pemfile is unmaintained
The rustls-pemfile crate is no longer maintained. The repository has been archived since August 2025, and users are encouraged to depend directly on the underlying PEM parsing code included in rustls-pki-types since 1.9.0. The latest version of rustls-pemfile…
-
Medium 6.1
Stack Memory Corruption Vulnerability
Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
-
Medium 6.5
Uniong｜WebITR - Arbitrary File Read
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
-
Medium 6.5
Uniong｜WebITR - SQL Injection
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
-
Medium 6.5
Uniong｜WebITR - SQL Injection
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
-
High 7.5
Uniong｜WebITR - Authorization Bypass
WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
-
Medium 4.3
Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login
The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for …
-
Medium 4.9
Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability m…
-
Medium 5.8
UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availabil…
-
High 7.3
Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerab…
-
Medium 6.2
Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability …
-
Medium 4.9
Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability m…
-
High 8.4
Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affe…
-
Medium 6.2
Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect …
-
Medium 5.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Medium 5.1
Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affec…
-
Medium 5.5
Permission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect …
-
Medium 6.6
Vulnerability of accessing invalid memory in the component driver module. Impact: Successful exploitation of this vulne…
-
Medium 5.1
Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affe…
-
High 8.0
Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability ma…
-
Medium 6.8
Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability …
-
Medium 6.4
UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may a…
-
High 7.3
DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may…
-
High 8.4
UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may a…
-
Medium 4.4
Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability…
-
Critical 9.3
Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability…
-
Medium 5.0
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible t…
-
Critical 9.4
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges…
-
Medium 5.0
Peppol-py is vulnerable to XXE attacks due to Saxon configuration
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
-
Low 2.9
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing…
-
High 8.2
app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, rel…
-
Medium 4.1
app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.
-
Low 2.8
Mustangproject allows exfiltrating files via XXE attacks
Mustang before 2.16.3 allows exfiltrating files via XXE attacks.
-
Medium 5.5
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.