Search Vulnerabilities

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Privacy/configuration issue when adding local data in views through 'unbound-control'

PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2

Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0

Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE

PraisonAI before 4.6.78 Prompt Injection Defense Bypass

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0)

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :m...

Appsmith: Caddy admin API exposed without authentication

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability

Insecure Default Domain Allowlist in Splunk AI Toolkit

Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier