Google Chromium V8 Type Confusion Vulnerability
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
RARLAB WinRAR Path Traversal Vulnerability
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories…
Microsoft Windows SMB Client Improper Access Control Vulnerability
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
Microsoft Windows External Control of File Name or Path Vulnerability
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Smartbedded Meteobridge Command Injection Vulnerability
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Microsoft Windows DWM Core Library Use-After-Free Vulnerability
Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.
Microsoft Windows Scripting Engine Type Confusion Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
Srimax Output Messenger Directory Traversal Vulnerability
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
ConnectWise ScreenConnect Improper Authentication Vulnerability
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to…
Commvault Web Server Unspecified Vulnerability
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Broadcom Brocade Fabric OS Code Injection Vulnerability
Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Vite Vitejs Improper Access Control Vulnerability
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
Google Chromium Mojo Sandbox Escape Vulnerability
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
D-Link DIR-823X Command Injection Vulnerability
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
Kentico Xperience Path Traversal Vulnerability
An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck…
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.