Latest CVE Feed
-
7.5
HIGHCVE-2025-30151
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security ... Read more
Affected Products : shopware- Published: Apr. 08, 2025
- Modified: Sep. 10, 2025
-
5.5
MEDIUMCVE-2025-30150
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-passw... Read more
Affected Products : shopware- Published: Apr. 08, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Information Disclosure
-
5.3
MEDIUMCVE-2024-31447
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the ... Read more
Affected Products : shopware- Published: Apr. 08, 2024
- Modified: Sep. 10, 2025
-
4.3
MEDIUMCVE-2025-48068
Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router ... Read more
Affected Products : next.js- Published: May. 30, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Information Disclosure
-
7.5
HIGHCVE-2024-27917
Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the ... Read more
Affected Products : shopware- Published: Mar. 06, 2024
- Modified: Sep. 10, 2025
-
3.7
LOWCVE-2025-32421
Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `p... Read more
Affected Products : next.js- Published: May. 14, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Race Condition
-
8.4
HIGHCVE-2025-43490
A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which might allow escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability.... Read more
Affected Products :- Published: Aug. 15, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Authorization
-
4.9
MEDIUMCVE-2025-53609
A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted re... Read more
Affected Products : fortiweb- Published: Sep. 09, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Path Traversal
-
5.9
MEDIUMCVE-2025-30218
Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, eve... Read more
Affected Products : next.js- Published: Apr. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Misconfiguration
-
8.1
HIGHCVE-2025-58370
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent w... Read more
Affected Products : roo_code- Published: Sep. 05, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Injection
-
6.7
MEDIUMCVE-2024-45325
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoS-F version 7.0.0 through 7.02 and before 6.6.3 may allow a privileged attacker to execute unauthorized code or comm... Read more
- Published: Sep. 09, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Injection
-
5.4
MEDIUMCVE-2025-9715
A vulnerability was found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_cms_assemble_control/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site script... Read more
Affected Products : o2oa- Published: Aug. 31, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Cross-Site Scripting
-
8.8
HIGHCVE-2025-8302
Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must ... Read more
- Published: Sep. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-8300
Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must ... Read more
- Published: Sep. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Memory Corruption
-
3.8
LOWCVE-2025-8298
Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of Realtek RTL8811AU dr... Read more
- Published: Sep. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Information Disclosure
-
7.8
HIGHCVE-2025-8301
Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek RTL8811AU drivers. An ... Read more
- Published: Sep. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-8299
Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi d... Read more
- Published: Sep. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Memory Corruption
-
7.7
HIGHCVE-2025-53781
Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network.... Read more
- Published: Aug. 12, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Information Disclosure
-
8.2
HIGHCVE-2025-55163
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control fra... Read more
Affected Products : netty- Published: Aug. 13, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-5824
Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An att... Read more
Affected Products : maxicharger_ac_elite_business_c50_firmware maxicharger_ac_elite_business_c50 maxicharger_ac_pro_firmware maxicharger_ac_pro maxicharger_ac_ultra_firmware maxicharger_ac_ultra maxicharger_dc_compact_mobile_firmware maxicharger_dc_compact_mobile maxicharger_dc_compact_pedestal_firmware maxicharger_dc_compact_pedestal +8 more products- Published: Jun. 25, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Authentication