Latest CVE Feed
-
7.5
HIGHCVE-2025-57816
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based ... Read more
Affected Products : fides- Published: Sep. 08, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Misconfiguration
-
7.5
HIGHCVE-2025-54599
The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own... Read more
Affected Products : events_and_groups- Published: Sep. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Authentication
-
7.5
HIGHCVE-2025-53805
Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.... Read more
- Published: Sep. 09, 2025
- Modified: Sep. 11, 2025
-
7.5
HIGHCVE-2025-58445
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers... Read more
Affected Products : atlantis- Published: Sep. 06, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Information Disclosure
-
7.5
HIGHCVE-2025-10832
A vulnerability was found in SourceCodester Pet Grooming Management Software 1.0. The affected element is an unknown function of the file /admin/fetch_product_details.php. The manipulation of the argument barcode results in sql injection. The attack may b... Read more
Affected Products : pet_grooming_management_software- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10857
A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack is possible t... Read more
Affected Products :- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10851
A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attac... Read more
Affected Products :- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-58296
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect function stability.... Read more
Affected Products : harmonyos- Published: Sep. 05, 2025
- Modified: Sep. 11, 2025
- Vuln Type: Race Condition
-
7.5
HIGHCVE-2025-10842
A vulnerability was detected in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/wew.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exp... Read more
Affected Products : online_bidding_system- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10836
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/print1.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely.... Read more
Affected Products : pet_grooming_management_software- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10831
A vulnerability has been found in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. The manipulation of the argument prodcode leads to sql injection. The attack is possible to be carried o... Read more
Affected Products : computer_sales_and_inventory_system- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10829
A vulnerability was detected in Campcodes Computer Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/sup_edit1.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the at... Read more
Affected Products : computer_sales_and_inventory_system- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10830
A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/inv_edit1.php. Executing manipulation of the argument idd can lead to sql injection. The attack can be executed remot... Read more
Affected Products : computer_sales_and_inventory_system- Published: Sep. 23, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-54919
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.... Read more
Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 +1 more products- Published: Sep. 09, 2025
- Modified: Sep. 12, 2025
-
7.5
HIGHCVE-2025-57925
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart Team allows PHP Local File Inclusion. This issue affects immonex Kickstart Team: from n/a through 1.6.9.... Read more
Affected Products :- Published: Sep. 22, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Path Traversal
-
7.5
HIGHCVE-2025-10811
A flaw has been found in code-projects Hostel Management System 1.0. This affects an unknown function of the file /justines/admin/mod_comments/index.php?view=view. Executing manipulation of the argument ID can lead to sql injection. The attack may be perf... Read more
Affected Products : hostel_management_system- Published: Sep. 22, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-59420
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacke... Read more
Affected Products : authlib- Published: Sep. 22, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Authentication
-
7.5
HIGHCVE-2025-8696
If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0.... Read more
Affected Products : stork- Published: Sep. 10, 2025
- Modified: Sep. 11, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-59049
Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from u... Read more
Affected Products :- Published: Sep. 10, 2025
- Modified: Sep. 11, 2025
- Vuln Type: Path Traversal
-
7.5
HIGHCVE-2025-8422
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the con... Read more
Affected Products :- Published: Sep. 11, 2025
- Modified: Sep. 11, 2025
- Vuln Type: Path Traversal