Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets…
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X s…
YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organiza…
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /layout/status/{id}` al…
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with…
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing authorization on `POST /displaygroup/criteria/{displa…
GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave…
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on `/notification/export/{…
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains an HTML injection vulnerability that allows remote attackers to inject malicious markup by crafting emails whose link text contains quo…
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Sel…
A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated…
A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially …
An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited …
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X…
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initia…
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete`…
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in …