Latest CVE Feed
-
8.8
HIGHCVE-2025-62726
n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository contain... Read more
Affected Products : n8n- Published: Oct. 30, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Injection
-
8.9
HIGHCVE-2025-12060
The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft ... Read more
Affected Products : keras- Published: Oct. 30, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Path Traversal
-
6.5
MEDIUMCVE-2025-62706
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allow... Read more
Affected Products : authlib- Published: Oct. 22, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Denial of Service
-
5.4
MEDIUMCVE-2025-62528
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has be... Read more
Affected Products : taguette- Published: Oct. 20, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Cross-Site Scripting
-
7.1
HIGHCVE-2025-62527
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if ... Read more
Affected Products : taguette- Published: Oct. 20, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Authentication
-
5.9
MEDIUMCVE-2025-62710
Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a... Read more
Affected Products : sakai- Published: Oct. 22, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Cryptography
-
7.1
HIGHCVE-2025-41073
Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total. This issue allows an authenticated attacker to download a ZIP file containing files from the server, including those located in parent directories (e.g., ..\..\..), by exploi... Read more
- Published: Oct. 23, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Path Traversal
-
6.5
MEDIUMCVE-2025-61464
gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php.... Read more
Affected Products : gnuboard- Published: Oct. 23, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Injection
-
7.0
HIGHCVE-2025-59194
Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally.... Read more
- Published: Oct. 14, 2025
- Modified: Oct. 30, 2025
-
7.0
HIGHCVE-2025-59195
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to deny service locally.... Read more
Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 +3 more products- Published: Oct. 14, 2025
- Modified: Oct. 30, 2025
-
7.0
HIGHCVE-2025-59196
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.... Read more
Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 +11 more products- Published: Oct. 14, 2025
- Modified: Oct. 30, 2025
-
5.5
MEDIUMCVE-2025-59197
Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally.... Read more
Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_10_1507 windows_11_23h2 +6 more products- Published: Oct. 14, 2025
- Modified: Oct. 30, 2025
-
5.0
MEDIUMCVE-2025-59198
Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.... Read more
Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 +11 more products- Published: Oct. 14, 2025
- Modified: Oct. 30, 2025
-
7.8
HIGHCVE-2025-59199
Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.... Read more
Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 +3 more products- Published: Oct. 14, 2025
- Modified: Oct. 30, 2025
-
8.1
HIGHCVE-2025-59250
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.... Read more
Affected Products : jdbc_driver_for_sql_server_12.8 jdbc_driver_for_sql_server_10.2 jdbc_driver_for_sql_server_12.6 jdbc_driver_for_sql_server_12.4 jdbc_driver_for_sql_server_12.10 jdbc_driver_for_sql_server_13.2 jdbc_driver_for_sql_server_12.2 jdbc_driver_for_sql_server_11.2 jdbc_driver_for_sql_server- Published: Oct. 14, 2025
- Modified: Oct. 30, 2025
-
6.1
MEDIUMCVE-2025-10869
Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerabil... Read more
Affected Products : chatbot- Published: Oct. 15, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Cross-Site Scripting
-
8.8
HIGHCVE-2025-62490
In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which ... Read more
Affected Products : quickjs- Published: Oct. 16, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-62491
A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). * The function js_std_promise_rejection_check attempts to iterate over... Read more
Affected Products : quickjs- Published: Oct. 16, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Memory Corruption
-
6.5
MEDIUMCVE-2025-62492
A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied. * The fromIndex argument (read as a double variabl... Read more
Affected Products : quickjs- Published: Oct. 16, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Memory Corruption
-
7.3
HIGHCVE-2025-64104
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string con... Read more
Affected Products :- Published: Oct. 29, 2025
- Modified: Oct. 30, 2025
- Vuln Type: Injection